Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug
HashiCorp, Veeam, and Django patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django The most critical flaw is a CVSS 10.0 cross-tenant credential-reuse bug in Terraform MCP Server's Streamable HTTP mode, allowing one user's Terraform token to be reused by subsequent users Veeam's highest-rated flaw (CVSS 9.5) enables unauthenticated impersonation of managed agents to steal credentials in the multi-tenant backup console GeoDjango's spatial lookup vulner
Analysis
TL;DR
- HashiCorp, Veeam, and Django patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django
- The most critical flaw is a CVSS 10.0 cross-tenant credential-reuse bug in Terraform MCP Server's Streamable HTTP mode, allowing one user's Terraform token to be reused by subsequent users
- Veeam's highest-rated flaw (CVSS 9.5) enables unauthenticated impersonation of managed agents to steal credentials in the multi-tenant backup console
- GeoDjango's spatial lookup vulnerability allows file writes to disk and potential remote code execution by staff users with view permissions on models containing spatial fields
- No active exploitation reported as of August 5, 2026, and none of the CVEs appear in CISA's Known Exploited Vulnerabilities catalog
Why It Matters
This patch cycle highlights critical security risks in AI-adjacent infrastructure, particularly the Terraform MCP Server which bridges AI assistants with infrastructure-as-code tooling—a growing attack surface as AI agents gain operational access. The cross-tenant isolation failures in both Veeam's multi-tenant console and HashiCorp's MCP server demonstrate how session management and credential caching flaws can lead to severe privilege escalation in shared environments. AI practitioners deploying MCP-based tooling must treat these vulnerabilities as urgent, especially since the affected configurations are precisely those designed for centralized, multi-user production deployments.
Technical Details
- Terraform MCP Server (HashiCorp): Three flaws in Streamable HTTP transport fixed in version 1.1.0+. CVE-2026-16498 (CVSS 10.0) is a cross-tenant credential-reuse bug where the MCP library's lack of unique session identifiers in stateless mode causes the server's credential cache to mix tokens across users. CVE-2026-16496 (CVSS 8.9) is the stateful-mode equivalent where the cache uses session ID as the sole lookup key without binding it to the originating token. CVE-2026-14869 (CVSS 8.6) is an SSRF flaw where request middleware inconsistently validates Terraform addresses depending on whether they arrive as HTTP headers or query parameters. Deployments using only stdio mode are unaffected.
- Veeam Service Provider Console: Four fixes in build 9.3.0.35057. CVE-2026-58073 (CVSS 9.5) allows unauthenticated agent impersonation to obtain managed agent credentials with high attack complexity. CVE-2026-58072 (CVSS 9.0) enables arbitrary file write leading to RCE requiring a low-privilege account. CVE-2026-58067 is an unauthenticated memory-exhaustion DoS, and CVE-2026-58071 exposes the proxied appliance API as Portal Administrator briefly after admin session start. All affect VSPC 9.2.1.33875 and earlier version 9 builds.
- Django/GeoDjango: Patched in versions 6.0.8 and 5.2.17. A spatial lookup flaw allows file writes to disk and potential code execution, reachable by any staff user with view permission on a registered model containing a spatial field.
- Scoring note: Veeam uses CVSS 4.0 while HashiCorp uses CVSS 3.1, making direct score comparisons invalid.
Industry Insight
- AI infrastructure tooling like MCP servers is entering production multi-tenant deployments faster than security hardening can keep pace; operators should audit their MCP configurations immediately, restrict Streamable HTTP listener access to trusted networks, and treat session IDs as sensitive credentials until upgraded.
- The recurrence of critical flaws in Veeam's console (second in three months) signals that multi-tenant SaaS platforms in the infrastructure management space need more rigorous isolation testing, particularly around session management and credential caching layers.
- Security teams should prioritize patching based on deployment configuration rather than CVSS scores alone—the Terraform MCP Server's stateful mode (CVSS 8.9) is likely more broadly exploitable in practice than its stateless mode flaw (CVSS 10.0) since stateful is the default for central deployments.
Disclaimer: The above content is generated by AI and is for reference only.