What is the CVSS score of EUVD-2026-49940?

EUVD-2026-49940 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of terraform-mcp-server are affected by EUVD-2026-49940?

HashiCorp's terraform-mcp-server contains an authorization bypass vulnerability allowing attackers who obtain a valid session identifier to execute infrastructure changes under another user's…. A patch is available.

How to fix or mitigate EUVD-2026-49940?

Within 24 hours, inventory all terraform-mcp-server deployments and identify which instances run in streamable-HTTP stateful transport mode-these are your immediate priority. Within 7 days, apply the available patch to all affected instances (versions 0.3.0 through 1.0.x) per the HashiCorp security advisory. Within 30 days, verify session isolation behavior post-patch, audit Terraform API audit logs for anomalous cross-user activity during the exposure window, and implement network segmentation to restrict access if streamable-HTTP mode cannot be disabled.

terraform-mcp-server EUVD-2026-49940

| CVE-2026-16496 HIGH

Session Fixation (CWE-384)

2026-07-28 HashiCorp

GHSA-4crw-p722-vr7h

Authentication Bypass Session Fixation Hashicorp Tooling

8.9

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

8.9 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

8.9 HIGH

Network-reachable HTTP transport (AV:N) but requires stealing a victim session ID (AC:H) with no attacker account (PR:N); cross-user credential misuse changes scope (S:C) with high confidentiality/integrity over managed infrastructure.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 28, 2026 - 19:02 EUVD

Analysis Generated

Jul 28, 2026 - 18:56 vuln.today

CVE Published

Jul 28, 2026 - 17:57 cve.org

HIGH 8.9

DescriptionCVE.org

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability, CVE-2026-16496, is fixed in terraform-mcp-server 1.1.0.

Articles & Coverage 1

News 3 New Hashicorp Vulnerabilities - 1 Critical, 2 High Jul 29, 2026

AnalysisAI

Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.

Technical ContextAI

The Model Context Protocol (MCP) server for Terraform exposes Terraform tooling to LLM/agent clients over a transport layer. The vulnerable configuration is the streamable-HTTP 'stateful' transport, which maintains per-user server sessions keyed by an MCP session ID. Because that session ID alone is treated as sufficient to bind tool invocations to a user's Terraform credentials, an actor who learns or reuses a valid session ID is authorized as that user - the CWE-384 (Session Fixation) root cause: session identifiers are not adequately bound to the authenticated principal or otherwise protected against reuse. The affected component is identified in CPE as cpe:2.3:a:hashicorp:tooling:*:*:*:*:*:*:*:* (HashiCorp Tooling), consistent with the terraform-mcp-server codebase.

RemediationAI

Vendor-released patch: 1.1.0 - upgrade terraform-mcp-server to 1.1.0 or later, which fixes CVE-2026-16496 as described in HashiCorp HCSEC-2026-23 (https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606). If immediate upgrade is not possible, stop using the streamable-HTTP stateful transport mode (switch to a stateless or non-shared transport, or run isolated single-user instances) so session IDs cannot be reused across users; the trade-off is loss of persistent multi-user session state. Additionally restrict network exposure of the MCP HTTP endpoint to trusted clients only and place it behind an authenticated, TLS-terminating reverse proxy to reduce the chance of session-ID interception, accepting added deployment complexity. Rotate and invalidate any potentially exposed session identifiers after upgrading.