terraform-mcp-server: stateless HTTP transport reuses one user's Terraform token for later callers

Impact

In stateless streamable-HTTP mode the server can carry a Terraform token from one caller into tool calls made by subsequent callers. Where this MCP server is the automation path into Terraform for a fleet - creating node pools, networks, storage, GPU instances - that means a low-privilege user's request can execute with another user's credential, and in a shared operator or multi-tenant setup with an admin-scoped token that is effectively infrastructure-wide write access. The record scores it 10.0 with a changed scope, reflecting that the damage lands in Terraform-managed infrastructure rather than in the MCP process. Nothing in the record indicates the reuse is bounded to a tenant.

Who can reach it

Any client able to reach the terraform-mcp-server HTTP endpoint and issue tool calls; no authentication of its own is needed to be handed the previous caller's credential. Exposure therefore follows wherever the endpoint is reachable from - an internal automation VLAN, a CI runner network, or an agent gateway.

What to do

Upgrade terraform-mcp-server to 1.1.0 and restart the service; this is a single daemon restart, no node disruption. Until then, stop serving the streamable-HTTP stateless transport (use stdio per-user, or keep one server instance per credential), and rotate any Terraform tokens that were handled by a shared instance, since the record does not bound who may have used them.

References

Related entries

• VeloCloud Orchestrator On-Prem: internal functionality reachable remotely, orchestrator host compromiseCVE-2026-16812 · Arista VeloCloud Orchestrator On-Prem (internal-only functionality exposed remotely)Critical
• Cisco Secure Firewall Management Center: unauthenticated HTTP request yields root on the applianceCVE-2026-20079 · Cisco Secure Firewall Management Center (web interface)Critical
• Dgraph: unauthenticated restoreTenant mutation overwrites the database and reads server-side filesCVE-2026-34976 · Dgraph (restoreTenant admin mutation, missing authorization middleware)Critical
• Kestra: suffix-match auth bypass on /configs gives unauthenticated workflow execution as rootCVE-2026-49869 · Kestra AuthenticationFilter (suffix match on the /configs path whitelist)Critical
• Kestra: any path ending in /configs skips Basic-Auth, giving unauthenticated flow execution as rootCVE-2026-53576 · Kestra (REST API authentication filter, /configs path suffix)Critical
• NVIDIA AIStore: legacy ETL API lets a remote caller set host namespaces and container security contextCVE-2026-65162 · NVIDIA AIStore (legacy ETL Kubernetes PodSpec initialization API)Critical