Server-Side Request Forgery in Terraform MCP Server by HashiCorp
CVE-2026-14869

8.6HIGH

Key Information:

Vendor

Hashicorp
Status
Tooling
Vendor
CVE Published:
28 July 2026

What is CVE-2026-14869?

The Terraform MCP Server prior to version 1.1.0 is susceptible to a server-side request forgery vulnerability within its streamable-HTTP transport mechanism. This flaw may enable an unauthenticated remote attacker to manipulate the server's Terraform API requests, potentially redirecting sensitive communications to endpoints controlled by the attacker. This vulnerability compromises server-side authorization tokens, posing a risk of unauthorized access to sensitive resources.

Affected Version(s)

Tooling 64 bit 0.3.0 < 1.1.0

References

https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vu...

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was identified by an internal team.
.