Terraform MCP, Veeam Console, Django Push Critical Patches — 11 CVEs Fixed, Including CVSS 10.0 Cross-Tenant Token Reuse Flaw

Summary

HashiCorp, Veeam, and the Django Software Foundation have released security updates addressing 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The most critical is CVE-2026-16498 – a cross-tenant credential reuse bug in HashiCorp's MCP server that allows one user's Terraform token to be reused for subsequent users' requests. Veeam patched an unauthenticated agent-credential leak (CVE-2026-58073) and an arbitrary file write leading to RCE. Django fixed a GeoDjango file-write flaw that can lead to code execution under specific conditions. No active exploitation has been confirmed, but operators are urged to upgrade immediately.

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Products	Vulnerability Type	Fixed Version
CVE-2026-16498	10.0 (CRITICAL)	0.33%	Terraform MCP Server versions 0.2.1 through 1.0.0	CWE-488: Exposure of Data Element to Wrong Session	1.1.0 or later
CVE-2026-16496	8.9 (HIGH)	0.27%	Terraform MCP Server versions 0.2.1 through 1.0.0	CWE-488: Exposure of Data Element to Wrong Session	1.1.0 or later
CVE-2026-14869	8.6 (HIGH)	0.29%	Terraform MCP Server versions 0.2.1 through 1.0.0	CWE-918: Server-Side Request Forgery (SSRF)	1.1.0 or later
CVE-2026-58073	9.5 (CRITICAL)	0.22%	Veeam Service Provider Console 9.2.1.33875 and all earlier version 9 builds	CWE-288: Authentication Bypass Using an Alternate Path or Channel	9.3.0.35057
CVE-2026-58072	9.0 (CRITICAL)	0.38%	Veeam Service Provider Console 9.2.1.33875 and all earlier version 9 builds	CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	9.3.0.35057
CVE-2026-58067	8.7 (HIGH)	0.30%	Veeam Service Provider Console 9.2.1.33875 and all earlier version 9 builds	CWE-789: Memory Allocation with Excessive Size Value	9.3.0.35057
CVE-2026-58071	8.2 (HIGH)	0.28%	Veeam Service Provider Console 9.2.1.33875 and all earlier version 9 builds	CWE-306: Missing Authentication for Critical Function	9.3.0.35057
CVE-2026-15307	8.8 (HIGH)	0.54%	Django versions prior to 6.0.8 and 5.2.17	CWE-73: External Control of File Name or Path CWE-918: Server-Side Request Forgery (SSRF)	6.0.8 or 5.2.17
CVE-2026-15920	6.1 (MEDIUM)	0.30%	Django versions prior to 6.0.8 and 5.2.17	CWE-83: Improper Neutralization of Script in Attributes in a Web Page	6.0.8 or 5.2.17
CVE-2026-15830	5.3 (MEDIUM)	0.52%	Django versions prior to 6.0.8 and 5.2.17	CWE-674: Uncontrolled Recursion	6.0.8 or 5.2.17
CVE-2026-15337	5.3 (MEDIUM)	0.52%	Django versions prior to 6.0.8 and 5.2.17	CWE-789: Memory Allocation with Excessive Size Value	6.0.8 or 5.2.17

Technical Information

HashiCorp Terraform MCP Server

HashiCorp's Terraform MCP Server, which bridges AI assistants with Terraform via the Model Context Protocol, carries three related vulnerabilities in its Streamable HTTP transport mode. Deployments using stdio mode (local single-user) are not affected — the bugs live in multi-user HTTP deployments.

CVE-2026-16498 – Cross-Tenant Credential Reuse

The most critical flaw stems from the underlying MCP library not generating unique session identifiers in stateless HTTP mode. The server's credential cache relied on these identifiers to distinguish users, allowing one user's Terraform token to be reused for subsequent users' requests regardless of the token they supplied. This effectively breaks tenant isolation in shared deployments.

CVE-2026-16496 – Stateful Mode Isolation Failure

In stateful mode (the default for central deployments), the cache used the MCP session ID as the sole lookup key without binding the cached client to the token that created it. A user who obtains another user's session ID can run tool calls with that victim's Terraform client, reaching resources permitted by the victim's token.

CVE-2026-14869 – Server-Side Request Forgery

Request middleware rejected a client-supplied Terraform address when it arrived as an HTTP header but not when the same value came through a query parameter. An unauthenticated caller able to reach the Streamable HTTP listener could make the server send its configured bearer token to an attacker-controlled endpoint.

Veeam Service Provider Console

Veeam patched four vulnerabilities in build 9.3.0.35057 (released July 29), affecting VSPC 9.2.1.33875 and all earlier version 9 builds. Two are rated critical.

CVE-2026-58073 – Unauthenticated Agent Impersonation

This flaw allows an unauthenticated attacker to impersonate a managed agent and obtain that agent's credentials. While it requires no login, the CVSS vector notes high attack complexity, making it less trivial than the score alone suggests.

CVE-2026-58072 – Arbitrary File Write → RCE

A low-privilege account can perform an arbitrary file write on the management server, which can lead to remote code execution depending on writable locations and application behavior.

CVE-2026-58067 – Unauthenticated Memory Exhaustion DoS

This vulnerability allows an unauthenticated attacker to exhaust host memory and cause a denial of service by sending specially crafted requests that trigger excessive memory allocation.

CVE-2026-58071 – Portal Administrator API Exposure

This flaw exposes the proxied appliance API as Portal Administrator during a short window after an administrator session begins, allowing an unauthenticated attacker to access the API with elevated privileges.

Django Framework

Django released 6.0.8 and 5.2.17 on August 4, addressing four CVEs. The highest-severity issue lies in GeoDjango.

CVE-2026-15307 – Server-side File Write & SSRF via Spatial Lookups

Spatial lookups in GeoDjango accepted str and dict values and passed them to GDALRaster when they appeared to represent rasters. Depending on the raster driver, this could write a file to disk (potentially enabling RCE if written to an importable location) or issue a network request as the Django process user. The documented admin attack path is reachable by staff users with view permission on a registered model containing a spatial field.

CVE-2026-15920 – Stored XSS in Admin

This moderate-severity vulnerability allows stored cross-site scripting in the admin interface where unsafe URLField values could be rendered as links and execute malicious JavaScript when clicked.

CVE-2026-15830 – DoS via Nested GEOMETRYCOLLECTION Objects

Deeply nested GEOMETRYCOLLECTION objects could trigger a GEOS segmentation fault, leading to denial of service. The fix now limits collections to 198 nested objects.

CVE-2026-15337 – Memory DoS in check_for_language()

This low-severity vulnerability allows memory-consumption denial of service in the check_for_language() function. The fix now rejects language codes longer than 500 characters.

Impact

Successful exploitation of these vulnerabilities carries severe consequences across all three products:

• Terraform MCP Server: Cross-tenant token reuse allows one tenant's Terraform token to be used by subsequent tenants, breaking multi-tenant isolation. Combined with the SSRF flaw, attackers could exfiltrate bearer tokens to attacker-controlled endpoints.
• Veeam Service Provider Console: Unauthenticated attackers can impersonate managed agents and steal credentials, while low-privilege users can write arbitrary files and achieve RCE.
• Django: Staff users with view permissions on spatial models can write files to disk or issue network requests via GeoDjango spatial lookups, potentially leading to remote code execution if files are written to importable locations.

In shared hosting and multi-tenant environments, these flaws are particularly dangerous as they can lead to tenant-to-tenant breaches, credential theft, and complete system compromise.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application (exploitation of Terraform MCP, Veeam Console, Django)	Initial Access (TA0001)
T1068	Exploitation for Privilege Escalation (cross-tenant token reuse, admin privilege escalation)	Privilege Escalation (TA0004)
T1499	Endpoint Denial of Service (memory exhaustion DoS in Veeam and Django)	Impact (TA0040)
T1102	Web Service (SSRF exfiltration of bearer tokens to attacker-controlled endpoints)	Command and Control (TA0011)

Mitigation and Solution

All three vendors have released security updates to remediate the 11 CVEs. Administrators should update affected installations to the following versions or later:

• HashiCorp Terraform MCP Server: Upgrade to 1.1.0 or later (1.2.0 was released August 4, 2026). If immediate upgrade is not possible, restrict network access to the Streamable HTTP listener to trusted users and treat MCP session IDs as sensitive values. Deployments running only in stdio mode are unaffected.
• Veeam Service Provider Console: Upgrade to 9.3.0.35057. This is the second critical patch for VSPC in three months. In May 2026, Veeam fixed CVE-2026-32998 (CVSS 9.4), an RCE tied to alarm script execution.
• Django Framework: Upgrade to 6.0.8 or 5.2.17. Older unsupported branches (5.1, 5.0, 4.2) were not evaluated and may also be affected. The fix for CVE-2026-15307 is backward-incompatible — spatial lookups now disallow dict values and strings that are not valid GEOSGeometry values.

Instantly Fix Risks with Saner Patch Management