terraform-mcp-server vulnerable to server side request forgery leading to token exposure
En bref
Sévérité
HIGH 8.6
EPSS
EPSS 0.39 % · centile 33 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
HashiCorp
Statut NVD
Deferred
Description
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.
