CVE-2026-14869 — terraform-mcp-server vulnerable to server side request forgery leading to token exposure
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote clie…
Published: 2026-07-28 · CVSS: 8.6 · CVSS 3.1
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7