CVE-2026-14869

CVE-2026-14869 is an SSRF in terraform-mcp-server's streamable-HTTP transport, but treating it as a standard SSRF understates the risk. The vulnerability lets an unauthenticated attacker redirect the server's outbound Terraform API calls to a controlled endpoint. What flows through that redirected channel is the authorization token—every Terraform operation (state reads, plans, applies) uses it. Compromising this token doesn't give you a port scan; it gives you persistent, credential-backed access to the target infrastructure. The transport-layer positioning is key. Streamable-HTTP multiplexes requests between MCP clients and the server, meaning the server simultaneously makes outbound calls to Terraform Cloud/Enterprise while accepting inbound requests. An attacker who manipulates this routing doesn't breach the server—they weaponize its outbound trust relationships. The server inherently trusts responses from the Terraform API, and now an attacker controls that channel. This is worse than traditional SSRF for a specific reason: MCP servers serve AI agents that consume tool outputs and reason about infrastructure state. An attacker redirecting Terraform responses can feed an AI agent manipulated state—convincing it a critical resource doesn't exist, that a security group is misconfigured, or that a planned change is safe when it isn't. The agent then executes destructive actions based on attacker-supplied premises. The EPSS score of 0.00293 measures exploitation likelihood for traditional deployments, but MCP servers increasingly run in CI/CD pipelines and AI agent frameworks where the attack surface differs from assumed baselines. What to check: First, verify you're on version 1.1.0 or later—these are the patched releases. Second, and critically, rotate any Terraform tokens the server used if there's any chance this was exploited in your environment. Patching alone is insufficient because the token itself may have been exfiltrated. Third, examine your streamable-HTTP transport configuration: determine whether client authentication was enforced or assumed as a precondition. If it was assumed, that's the vulnerable design pattern. Finally, audit your MCP server's network egress—the vulnerability exploited outbound call routing, so controls on where the server can make requests matter. Organizations running MCP as part of automated AI-agent pipelines should treat this as a credential-compromise incident, not just a server-patching exercise.

Reviewed through automated stages and approved by a human before publication.