Skip to main content

Tooling CVE-2026-16498

| EUVDEUVD-2026-49941 CRITICAL
Exposure of Data Element to Wrong Session (CWE-488)
2026-07-28 HashiCorp GHSA-vq72-755f-9mrm
Information Disclosure Hashicorp Tooling
10.0
CVSS 3.1 · Vendor: HashiCorp
Share

Severity by source

Vendor (HashiCorp) PRIMARY
10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Primary rating from Vendor (HashiCorp) · only source for this CVE.

CVSS VectorVendor: HashiCorp

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Patch available
Jul 28, 2026 - 19:02 EUVD
Analysis Generated
Jul 28, 2026 - 18:55 vuln.today
CVE Published
Jul 28, 2026 - 17:57 cve.org
CRITICAL 10.0

DescriptionCVE.org

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

Articles & Coverage 2

News 3 New Hashicorp Vulnerabilities - 1 Critical, 2 High Jul 29, 2026 News Critical Vulnerability in Hashicorp - CVE-2026-16498 Jul 28, 2026

AnalysisAI

Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on behalf of other users. The vulnerability affects versions prior to 1.1.0 when the server is run in streamable-HTTP stateless transport mode. No public exploit code is known, but the critical CVSS score and network attack vector indicate high potential risk.

More in Tooling

View all
CVE-2026-16326 CRITICAL
10.0 Jul 29

Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication
CVE-2026-8715 CRITICAL
9.6 Aug 13

Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes te
CVE-2026-16496 HIGH
8.9 Jul 28

Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains ano
CVE-2026-14869 HIGH
8.6 Jul 28

Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to re
CVE-2026-16328 HIGH
8.6 Jul 29

Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the se
CVE-2026-87993 HIGH
7.7 Sep 10

Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to impr
CVE-2026-4660 HIGH
7.5 Apr 09

Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote att
CVE-2026-5061 MEDIUM
4.7 May 12

Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended

Same weakness CWE-488 – Exposure of Data Element to Wrong Session

View all
CVE-2024-38367 CRITICAL POC
9.6
CVE-2024-27935 HIGH POC
8.3
CVE-2026-88017 HIGH POC
7.3
CVE-2026-16326 CRITICAL
10.0
CVE-2026-19931 CRITICAL POC
9.8
CVE-2024-27455 CRITICAL
9.1
CVE-2026-71850 MEDIUM POC
4.8
CVE-2026-86492 HIGH
8.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-16498 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy