The terraform-mcp-server before version 1.1.0 has a critical authorization bypass. In the streamable‑HTTP stateful transport mode, a user who can acquire another user's MCP session ID can cause their tool calls to run with the victim’s Terraform credentials. This allows the attacker to execute arbitrary Terraform operations, potentially exposing secrets, modifying infrastructure, and escalating privileges. The weakness is classified as CWE‑384.

HashiCorp’s Terraform MCP Server, all releases prior to 1.1.0, is affected. The vulnerability is present in the Tooling category by HashiCorp; any deployment of terraform-mcp-server older than version 1.1.0 can be exploited.

The CVSS score of 8.9 indicates a high severity impact. The EPSS score is < 1 %, suggesting a low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to obtain a victim’s MCP session ID—through network interception of unencrypted traffic, session fixation, or other session hijacking techniques—then send malicious requests over the streamable‑HTTP interface. Protecting traffic with TLS and monitoring session activity reduces the attack window.