# A CVSS 10.0 bug let one user's Terraform token serve another user's request

Source: https://startwithidentity.com/blog/2026-08-05-terraform-mcp-server-cross-tenant-token-reuse/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

HashiCorp, Veeam, and the Django Software Foundation patched 11 vulnerabilities in early August 2026. The most severe is CVE-2026-16498 in HashiCorp's Terraform MCP Server, CVSS 10.0, affecting versions 0.3.0 through 1.0.0 in stateless HTTP mode: the underlying MCP library did not assign unique session identifiers, so one user's Terraform token could be reused for later requests regardless of the token those users supplied. Fixed in 1.1.0. Veeam patched CVE-2026-58073 (CVSS 9.5) in Service Provider Console, where an unauthenticated attacker could impersonate a managed agent and obtain its credentials, fixed in 9.3.0.35057. Django patched CVE-2026-15307 in 6.0.8 and 5.2.17.

## Why it matters

Cross-tenant token reuse is the failure mode to watch as [Model Context Protocol](https://startwithidentity.com/glossary/agentic-identity/) servers proliferate. An MCP server sits between an agent and a privileged API, which makes it a credential broker, and a broker that loses track of whose credential belongs to whose session is worse than no broker at all: it grants access silently and correctly from the API's point of view. Stateless HTTP mode is exactly where this goes wrong, because "stateless" and "must not confuse two callers" are in tension unless session identity is explicit. If you run MCP servers against infrastructure APIs, upgrade, then audit for per-request identity binding rather than assuming the framework provides it, and scope the underlying tokens so a mix-up cannot cross an environment boundary. See [token exchange](https://startwithidentity.com/glossary/token-exchange/).

Source: [The Hacker News](https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html)