CVE-2026-16498

The record

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

Affected packages

Related vulnerabilities

• CVE-2026-115419 The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon… CWE-488
• CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the… CWE-488
• CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter… CWE-488
• CVE-2026-107929 When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with… CWE-488
• CVE-2026-86411 An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control… CWE-488
• CVE-2026-84685 The react-native-auth0 SDK's web platform implementation does not scope its in-memory… CWE-488
• CVE-2026-86492 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft… CWE-488
• CVE-2026-80231 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given… CWE-488