The vulnerability is a server‑side request forgery in the streamable‑HTTP transport of terraform‑mcp‑server. An unauthenticated remote client can redirect the server’s Terraform API traffic, including the server‑side authorization token, to a malicious endpoint. This leakage of the token enables an attacker to impersonate the server and perform API calls with the bearer token, potentially granting unauthorized control over Terraform resources. The weakness maps to CWE‑918.

This flaw affects the HashiCorp tooling component terraform‑mcp‑server version 1.0.x and earlier, before 1.1.0. The product is distributed by HashiCorp as part of its Terraform offering.

With a CVSS score of 8.6 the vulnerability is high severity. The EPSS score of less than 1% indicates a low probability of real‑world exploitation at present. The vulnerability is not currently listed in CISA's KEV catalog. The attack vector requires a remote, unauthenticated client able to reach the streamable‑HTTP endpoint; once achieved, SSRF can be leveraged to exfiltrate the authorization token and any downstream resources.