Overview
HashiCorp, Veeam, and the Django Software Foundation have collectively patched 11 vulnerabilities in a coordinated disclosure window spanning late July to early August 2026. The most severe is a CVSS 10.0 cross-tenant token reuse bug in HashiCorp’s Terraform MCP Server — the component that connects AI assistants to Terraform infrastructure over the Model Context Protocol (MCP). The flaw allows one authenticated user’s Terraform token to persist and be reused for a subsequent user’s requests, effectively enabling cross-tenant privilege escalation in AI-driven infrastructure automation pipelines.
Technical Analysis
Terraform MCP Server (CVSS 10.0): Three related flaws affect the Streamable HTTP transport mode of the Terraform MCP Server. When an AI assistant connects via Streamable HTTP rather than stdio, session isolation between users is broken, allowing a token issued to one user to bleed into subsequent requests from a different user. This is a session management failure at the MCP transport layer — directly impacting AI agent workflows that rely on the server to execute Terraform operations. The fixed version is 1.1.0, released July 1.
Veeam Service Provider Console (CVE-2026-58073, CVSS 9.5): An unauthenticated attacker can impersonate a managed backup agent and retrieve that agent’s credentials. While attack complexity is rated High — meaning exploitation is non-trivial — the lack of any authentication requirement makes this a priority target for motivated adversaries in MSP environments. A second critical flaw (CVE-2026-58072, CVSS 9.0) permits arbitrary file write leading to RCE with only a low-privilege account.
Django GeoDjango (Spatial Lookups): A file write vulnerability reachable by a staff user with view permission on a spatial model field can lead to code execution on misconfigured deployments. The attack path requires internal access but is notable for its low permission threshold.
None of the eleven CVEs appear in CISA’s Known Exploited Vulnerabilities catalog as of August 5, 2026, and no public proof-of-concept has been published.
Framework Mapping
The Terraform MCP Server flaw maps directly to LLM07 (Insecure Plugin Design) under OWASP LLM Top 10, as the MCP Server functions as a plugin/tool layer for AI assistants, and its failure to isolate sessions enables unintended cross-user data and credential access. LLM06 (Sensitive Information Disclosure) applies given that valid authentication tokens are leaked across tenant boundaries. From a MITRE ATLAS perspective, AML.T0047 (ML-Enabled Product or Service) is relevant as the vulnerability sits within infrastructure explicitly designed to extend AI assistant capabilities.
The Veeam credential theft path aligns with AML.T0012 (Valid Accounts) — compromised agent credentials could be weaponised for lateral movement within backup infrastructure.
Impact Assessment
The Terraform MCP Server flaw poses the highest systemic risk to organisations adopting AI-driven infrastructure automation. Any deployment running Streamable HTTP mode before version 1.1.0 is potentially exposed to cross-tenant token theft. Veeam VSPC users in MSP or multi-tenant environments face credential compromise without requiring attacker authentication. Django impacts are more constrained but relevant to organisations running GeoDjango-powered applications with staff-level internal threat models.
Mitigation & Recommendations
- Update Terraform MCP Server to version 1.1.0 or later; switch to stdio transport where Streamable HTTP is not required.
- Upgrade Veeam VSPC to build 9.3.0.35057 without delay; audit agent credential stores post-upgrade.
- Patch Django to 6.0.8 or 5.2.17; review staff account permissions on models containing spatial fields.
- Monitor CISA KEV and vendor security channels for exploitation status changes.