HashiCorp discloses five vulnerabilities across its Terraform and Consul MCP servers, two rated CVSS 10.0 in advisory records

HashiCorp published two security bulletins one day apart. HCSEC-2026-23 (July 28) covers the Terraform MCP Server, versions 0.2.1 through 1.0.0 with fixes in 1.1.0, and HCSEC-2026-24 (July 29) covers the Consul MCP Server, versions 0.1.0 through 0.1.3 with fixes in 0.1.4. Both center on the streamable-http transport in centralized, multi-user deployments. The fixed Terraform release shipped July 14, two weeks ahead of the bulletin, the normal coordinated-disclosure ordering.

The Terraform bulletin describes three issues. CVE-2026-14869 is a server-side request forgery: middleware rejected a client-supplied Terraform address in an HTTP header but not the same value as a query parameter, letting an unauthenticated client redirect the server's bearer token to an attacker-controlled endpoint. CVE-2026-16496 is an authorization bypass in stateful mode, where the per-session Terraform client cache used the MCP session ID as its sole lookup key without binding cached clients to the token that created them. CVE-2026-16498 is cross-tenant credential reuse in stateless mode: with no session identifiers to key on, one tenant's credentials were reused for subsequent tenants' requests.

The Consul bulletin describes the same two outer failure modes: CVE-2026-16328, an unrestricted client-supplied override of the Consul backend address that can exfiltrate the configured token, and CVE-2026-16326, cross-tenant credential reuse in stateless mode.

On severity, attribution matters: HashiCorp's bulletins state no CVSS scores and no severity labels. The scores come from the GitHub advisory records, which rate both stateless-mode cross-tenant flaws (CVE-2026-16498 and CVE-2026-16326) Critical at CVSS 10.0, and the remaining three High at 8.9 and 8.6. Both perfect-score flaws share a shape worth naming: removing the protocol session does not remove the need to bind a request to a principal, and a session-keyed cache in a sessionless mode fails across tenants. HashiCorp's interim mitigations are restricting network access to the streamable-http listener and treating MCP session IDs as sensitive values.