CVE-2026-16498

This vulnerability is a credential scoping failure — users of terraform-mcp-server can receive other users' Terraform tokens in their requests. The server is leaking authentication state across session boundaries, which is a direct violation of the trust model for middleware that should transparently代理 between LLMs and backend systems. The root cause is almost certainly a concrete implementation mistake, not an architectural inevitability. Streamable-HTTP transport doesn't mandate global credential state — the protocol is fine. What failed is code that didn't scope auth context to the right boundary, likely in HTTP connection pooling or in-process credential caching. This is the same class of bug that's appeared in reverse proxies, API gateways, and TLS session resumption — developers treat stateless transports as a license to cache aggressively without active scoping discipline. The CVSS 10 rating actually understates the real impact. A Terraform token isn't just an API credential — it controls infrastructure state. Read access exposes sensitive state files and secrets. Write access can rewrite cloud resources at scale. One misdelivered token can become an infrastructure takeover. For defenders: prioritize upgrading to 1.1.0 immediately. Beyond that, audit for pooled connections that may still contain pre-fix credential state — connection pools, in-flight requests, and replicas that haven't restarted may still hold abandoned credentials from the vulnerable version. This is a regression risk: the fix may be restoring scoping that existed in an earlier version and was removed as 'unnecessary complexity' during optimization. The broader question is whether other MCP servers using streamable-HTTP have the same missing guard. The pattern is reproducible because the ecosystem has never settled on clear idioms for where auth context lives in stateless transports. Treat transport mode selection as a security-relevant architectural decision — don't assume 'stateless' implicitly protects you.

Reviewed through automated stages and approved by a human before publication.