CVE-2026-16498

The terraform-mcp-server prior to version 1.1.0 is susceptible to a critical cross-tenant credential reuse vulnerability that enables an attacker to exploit one user's Terraform token to perform unauthorized actions on behalf of other users. This flaw poses a significant risk to organizations using this tool, as it could lead to unauthorized access and manipulation of resources. All users of terraform-mcp-server should prioritize upgrading to version 1.1.0 or later to mitigate this severe security risk.