terraform-mcp-server: knowing another user's MCP session ID runs tool calls with their Terraform credentials

Impact

A separate flaw from the stateless credential reuse in the same advisory: here the stateful transport treats possession of an MCP session ID as authorization, so anyone who obtains a session ID executes Terraform tool calls under that session's credentials. For an operator this is privilege escalation into infrastructure provisioning - whatever the victim's Terraform token can change in the fleet, the attacker can change. Session IDs are the kind of value that leaks through logs, proxy traces and error output, so the practical barrier is lower than the high attack complexity in the vector suggests.

Who can reach it

A remote client that can reach the server's HTTP endpoint and has learned a valid session ID belonging to another user. No credential of the attacker's own is required; the record states no prior authentication.

What to do

Upgrade terraform-mcp-server to 1.1.0 and restart the service - a daemon restart only. Before the upgrade, restrict who can reach the HTTP endpoint and avoid the shared stateful transport for privileged Terraform tokens; afterwards, invalidate existing sessions and rotate tokens whose session IDs may have been exposed in logs or proxies.

References

Related entries

• Ceph CephX (authentication protocol): A tenant holding one low-privilege CephX client key ends up with cluster-wideNCVD-2025-016-ceph-cephx-authentication-protoc · Ceph CephX (authentication protocol)High
• GlusterFS (brick, server-rpc-fops.c): Multiple stack buffer overflows from fixed-size alloca() allocations in the brickCVE-2018-10907 · GlusterFS (brick, server-rpc-fops.c)High
• GlusterFS (brick, gfs3_symlink_req): Symlink creation is not confined to the volume, so a client plants a link pointingCVE-2018-10928 · GlusterFS (brick, gfs3_symlink_req)High
• NetApp Clustered Data ONTAP export policy enforcement (SMBv2/SMBv3): Export policy rules marked read-only are notCVE-2018-5490 · NetApp Clustered Data ONTAP export policy enforcement (SMBv2/SMBv3)High
• Schneider Electric Data Center Expert 7.5.0 and earlier - zip upload: A crafted zip uploaded through the DCE UI canCVE-2018-7807 · Schneider Electric Data Center Expert 7.5.0 and earlier - zip uploadHigh
• CyberPower PowerPanel Business Edition 3.4.0 Agent/Center: Cross-site request forgery across all forms in the webCVE-2019-13071 · CyberPower PowerPanel Business Edition 3.4.0 Agent/CenterHigh