All posts
Supply Chain Compromise

HashiCorp MCP: Shared-Transport Token Boundary Fails

HashiCorp disclosed five CVEs across Consul and Terraform MCP servers in two days — each collapses the streamable-HTTP identity boundary

Securityv0 Intelligence Team OWASP: ASI06 sv0 finding: nhi_compromise
hashicorp mcp nhi-compromise consul terraform streamable-http

The Incident

On 2026-07-28 and 2026-07-29, HashiCorp published back-to-back security advisories against its own two Model Context Protocol servers. HCSEC-2026-23 disclosed three CVEs in terraform-mcp-server 0.2.1 through 1.0.0, fixed in 1.1.0. HCSEC-2026-24 disclosed two CVEs in consul-mcp-server 0.1.0 through 0.1.3, fixed in 0.1.4. Every one of the five vulnerabilities lives in the streamable-HTTP transport and moves a machine identity — a Consul ACL token, a Terraform HCP or TFE bearer token, or an MCP session identifier acting as a credential proxy — outside the caller it was bound to.

Two of the CVEs are of the server-side request forgery flavor. CVE-2026-14869 (Terraform, CVSS 8.6 HIGH) allows a remote caller to redirect the server’s outbound Terraform API requests to an attacker-controlled endpoint, sending the configured bearer token along for the ride; CVE-2026-16328 (Consul, CVSS 8.6 HIGH) does the same to the server’s Consul token via an unrestricted request-header override of the backend address. The remaining three are cross-caller credential confusion in the streamable-HTTP transport itself. CVE-2026-16496 (Terraform, CVSS 8.9 HIGH) lets a caller who obtains another user’s MCP session ID execute tools with that user’s Terraform credentials. CVE-2026-16326 (Consul, CVSS 10.0 CRITICAL, CWE-488) does not isolate session state in stateless mode, so one client’s Consul token is reused when serving subsequent clients. CVE-2026-16498 is the same class of cross-tenant credential reuse in Terraform’s stateless mode. Patches ship in terraform-mcp-server 1.1.0 and consul-mcp-server 0.1.4. No exploitation in the wild has been reported.

MITRE ATT&CK coverage: T1090.002 — Proxy: External Proxy (the SSRF and backend-override redirect), T1550.001 — Use Alternate Authentication Material: Application Access Token (session-ID theft and stateless-mode reuse), T1552 — Unsecured Credentials (bearer tokens and ACL tokens reachable outside the intended caller).

The Authority Path That Failed

Every streamable-HTTP MCP server is designed to be run as a single central process serving many concurrent callers. Each caller is expected to bring its own principal — a Terraform HCP or TFE token, a Consul ACL token — as an HTTP header on each request, and the server is the authority that reaches downstream APIs on behalf of that caller. That is the intended scope: one server process, N tokens, each token bound to a single caller and a single request. The identity that carried execution authority in each incident was the MCP server process, and the intended scope for any given token was “reach the downstream API for the caller that supplied this token, and no one else.”

The scope the transport actually exercised broke the boundary at two layers. In the SSRF pair, the destination of the credentialed request was governed by client-supplied input the server never validated, so the caller could point the next tokenized request at any URL — an attacker endpoint at that point receives both the request and the token. In the session and state pair, the caller-to-token binding was never enforced past the transport: MCP session IDs were not bound to the principal that established them, and per-request credential state was not isolated between callers in stateless mode. In both flavors the trust anchor was implicit — the shared server assumed the transport had already answered “which caller does this credential belong to,” when in fact the transport had punted.

SecurityV0 Perspective

This is a nhi_compromise finding by design, not by exploit. Every failure surface is a non-human identity — a Consul ACL token, a Terraform bearer token, or an MCP session ID acting as a credential proxy — reachable by the wrong caller. The specific CVEs will get patched; the pattern is more durable, because shared streamable-HTTP MCP servers concentrate high-value NHIs in one process and the industry has not yet worked out how to bind them to the right caller through the transport.

What To Do

  • Upgrade the MCP servers before the next callers connect. terraform-mcp-server 1.1.0 fixes CVE-2026-14869, CVE-2026-16496, and CVE-2026-16498. consul-mcp-server 0.1.4 fixes CVE-2026-16328 and CVE-2026-16326. There is no runtime mitigation for the SSRF or cross-caller CVEs short of taking the streamable-HTTP transport off the network.
  • Rotate every Consul ACL token and Terraform bearer token that a vulnerable version could reach. First isolate and upgrade the vulnerable server, then revoke and reissue every token it could access via HCP, Terraform Cloud, and Consul ACL admin flows. Rotating while the vulnerable process remains reachable can expose the replacement credential.
  • Audit MCP session IDs against the principals that established them. Under CVE-2026-16496 a caller with another user’s session ID executes tools with that user’s Terraform credentials. Query the MCP server session table (or its access logs) for any session ID seen under more than one source IP or user-agent during the exposure window; those are the sessions most likely to have been reused across callers.
  • Refuse to run MCP servers on 0.0.0.0 without a caller-authenticating reverse proxy. Both SSRF CVEs require only that a caller reach the streamable-HTTP transport, and the Terraform-side flaw does not require the caller to authenticate. If the MCP server must accept remote callers, front it with a reverse proxy that terminates mTLS or OAuth per caller and rejects request headers that override backend routing.
  • Add an NHI inventory that pins each credential to its intended caller. The generalizable defense here is not “patch faster” — it is knowing, per shared MCP process, which downstream credentials are in scope and which caller each session belongs to. A caller-to-NHI reconciliation that fires when a credential is reachable outside its intended caller would have surfaced all five CVEs’ effects at deployment time.

Sources

All posts