CVE-2026-16496

The record

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability, CVE-2026-16496, is fixed in terraform-mcp-server 1.1.0.

Affected packages

Related vulnerabilities

• CVE-2026-121501 A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. CWE-384
• CVE-2026-82840 Session fixation in Apache Wicket. CWE-384
• CVE-2026-115910 Python Social Auth is a social authentication and registration mechanism. CWE-384
• CVE-2024-34324 An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session… CWE-384
• CVE-2026-107226 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-384
• CVE-2026-82355 When a request to the Airflow core API carries both a session cookie and an explicit… CWE-384
• CVE-2026-64857 tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. CWE-384
• CVE-2026-86674 A vulnerability was found in ningzichun Student Management System up to… CWE-384