terraform-mcp-server: SSRF redirects the server's Terraform API calls and its token to an attacker endpoint

Impact

An unauthenticated client can make the server send its Terraform API requests - carrying the server-side authorization token - to a destination the attacker controls. That hands over the credential the automation path uses to drive infrastructure, and the token is then usable directly against Terraform outside the MCP server. The onward requests also originate from inside the operator's network, so the same primitive can reach internal endpoints that are not exposed externally. This is the third distinct flaw in the same advisory and is kept separate because the mechanism and the blast radius differ from the two credential-confusion issues.

Who can reach it

Any unauthenticated remote client that can reach the streamable-HTTP transport endpoint. No credential or session is needed.

What to do

Upgrade terraform-mcp-server to 1.1.0 and restart the service. Treat the server-side Terraform token as compromised if the endpoint was reachable from untrusted networks and rotate it, and restrict egress from the host running the MCP server so a redirected request cannot leave the network.

References

Related entries

• Grafana MCP Server: crafted X-Grafana-URL header leaks the service-account token and enables SSRFCVE-2026-15583 · Grafana MCP Server (X-Grafana-URL request header handling)High
• Ivanti Endpoint Manager (EPM): Auth bypass via alternate pathCVE-2026-1603 · Ivanti Endpoint Manager (EPM)High
• Pure Storage FlashArray Purity (management interface privilege bypass): An authenticated low-privileged user reachesCVE-2026-6444 · Pure Storage FlashArray Purity (management interface privilege bypass)High
• NVIDIA AIStore: dSort fetches an attacker-supplied external key map URL (SSRF)CVE-2026-65101 · NVIDIA AIStore (distributed sort, external key map URL)High
• NVIDIA AIStore: experimental HT backend fetches a crafted original URL (SSRF)CVE-2026-65170 · NVIDIA AIStore (experimental HT backend, original URL handling)High
• NVIDIA AIStore: ETL management API missing authorization on job read and start/stopCVE-2026-65172 · NVIDIA AIStore (ETL management API, proxy GET/POST)High