terraform-mcp-server CVE-2026-16496

Exploitation requires that terraform-mcp-server (version 0.3.0 to <1.1.0) be running specifically in the streamable-HTTP stateful transport mode, and that the attacker first obtain a valid MCP session ID belonging to another user. Limiting factors: the vulnerable stateful HTTP transport is a specific, non-universal deployment choice (stateless setups are not affected the same way), and the attack is gated on acquiring the victim's session identifier (reflected in CVSS AC:H), which is why CISA SSVC marks it Automatable=no. No attacker-side authentication account is needed (PR:N), but victim session material is a hard prerequisite, and the practical impact is scoped to whatever Terraform credentials the hijacked session holds.

The signals are mixed and should be read together. CVSS 8.9 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) reflects network reach, no required attacker privileges, and a scope change into managed Terraform infrastructure - but AC:H acknowledges the non-trivial precondition of obtaining a valid session ID. Real-world exploitation probability appears low: EPSS is 0.27% (19th percentile), CISA SSVC lists Exploitation=none and Automatable=no (so it is not a spray-and-pray target), even though Technical Impact=total captures the severity if exploited. There is no KEV listing and no public exploit identified. Net: this is a high-severity issue for organizations exposing the stateful HTTP transport in multi-user contexts, but it is a targeted, condition-dependent flaw rather than a mass-exploitation threat - patch on a normal-to-elevated priority track, escalating if the stateful HTTP mode is internet-exposed. Note the tension between PR:N and the AC:H prerequisite of session-ID theft: no attacker account is needed, but victim session material is required, so 'unauthenticated' should not be read as 'trivially remote.'

In a shared terraform-mcp-server deployment running the streamable-HTTP stateful transport, an attacker captures or reuses another user's MCP session ID (for example via network interception, logs, or a leaked token). Replaying that session ID, the attacker issues Terraform tool calls that execute with the victim's Terraform credentials, potentially reading state, modifying infrastructure, or exfiltrating secrets. No public exploit is identified, and the AC:H rating reflects that the attacker must first acquire valid session material.