What is CVE-2026-16498?

CVE-2026-16498 is a critical-severity vulnerability in Hashicorp Tooling, classified under CWE-488. CVSS score: 10.0/10. Published 2026-07-28.

How severe is CVE-2026-16498?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Vulnerability in Hashicorp Tooling

CVE-2026-16498

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

EPSS: 0.005 (38.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.

Affected products

Hashicorp Tooling — versions 0.3.0

Weakness classification (CWE)

CWE-488

References

security@hashicorp.com

Frequently asked questions

What is CVE-2026-16498?: CVE-2026-16498 is a critical-severity vulnerability in Hashicorp Tooling, classified under CWE-488. CVSS score: 10.0/10. Published 2026-07-28.
How severe is CVE-2026-16498?: Critical severity. CVSS v3 base score is 10.0 out of 10.