The Terraform MCP Server had a flaw that allowed one tenant’s Terraform token to be reused by another tenant when the server was configured with streamable‑HTTP stateless transport. This cross‑tenant credential reuse, recorded as CWE‑488, lets an attacker leverage a legitimate token to execute tool calls on behalf of another user, effectively granting unauthorized control over that tenant’s workspace and the ability to alter infrastructure or expose secrets.

HashiCorp’s terraform‑mcp‑server versions prior to 1.1.0 are affected. The issue manifests only when the streamable‑HTTP stateless transport mode is enabled, so any deployment running a vulnerable version with this mode active is at risk.

The CVSS score of 10 marks the vulnerability as critical, while an EPSS below 1% indicates a low exploitation probability at this time. The flaw is not listed in CISA KEV. Attackers need to acquire a valid Terraform token from a victim tenant; with that, they can make API requests to the stateless endpoint and reuse the token to perform privileged operations for other tenants, all over the network without local compromise.