terraform-mcp-server vulnerable to server side request forgery leading to token exposure
At a glance
Severity
HIGH 8.6
EPSS
EPSS 0.39 % · percentile 33 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
HashiCorp
NVD status
Deferred
Description
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.
