CVE-2026-16498 — a CVSS 10.0 cross-tenant credential‑reuse bug — lets one user's Terraform token be reused for later users' requests, a flaw that sits at the center of a three-vendor patch cycle spanning Terraform MCP Server, Veeam Service Provider Console, and Django's GeoDjango.
HashiCorp Terraform MCP Server: cross‑tenant token reuse in Streamable HTTP
HashiCorp disclosed three related flaws in the Terraform MCP Server's Streamable HTTP transport on July 28 and provided fixes in version 1.1.0. The most severe, CVE-2026-16498 (CVSS 10.0), is a cross‑tenant credential‑reuse bug that arises because the MCP library did not assign unique session identifiers in stateless HTTP mode; the server's credential cache relied on session identifiers to separate tenants, so one user's Terraform token could be reused for later users' requests regardless of the token supplied.
Two companion issues accompany that isolation failure. CVE-2026-16496 (CVSS 8.9) is the stateful‑mode variant: the server's cache used the MCP session ID as the sole lookup key without binding the cached client to the token that created it, allowing a user who obtained another user's session ID to run tool calls with the victim's Terraform client. CVE-2026-14869 (CVSS 8.6) is a server‑side request forgery where middleware rejected a client‑supplied Terraform address when sent as an HTTP header but not when the same value came through a query parameter, which could cause the server to send its configured bearer token to an attacker‑controlled endpoint.
HashiCorp notes that deployments running only in stdio (local single‑user) mode are unaffected; the flaws live in the multi‑user HTTP configuration that centralizes the server. There is a discrepancy in affected‑version ranges across HashiCorp publications — the umbrella bulletin lists versions 0.2.1 through 1.0.0 while individual CVE records begin at 0.3.0 — but both agree that version 1.1.0 is the first fixed release. HashiCorp released the fixed build on July 14 and followed with version 1.2.0 on August 4. Juan Pablo Martinez Kuhn of Coinspect reported the cross‑tenant issue; HashiCorp discovered the other two internally.
Veeam Service Provider Console: unauthenticated agent impersonation and arbitrary file write
Veeam patched four vulnerabilities in the Service Provider Console (VSPC) with build 9.3.0.35057, released July 29 and documented in a security bulletin published August 4. Two are critical. The headline is CVE-2026-58073 (CVSS 9.5), an unauthenticated flaw that can let an attacker impersonate a managed agent and obtain that agent's credentials; the CVSS vector rates attack complexity as high. The other critical issue, CVE-2026-58072 (CVSS 9.0), is an arbitrary file write on the management server that can lead to remote code execution and requires only a low‑privilege account.
Two additional high‑severity bugs round out the set: CVE-2026-58067, an unauthenticated memory‑exhaustion denial of service, and CVE-2026-58071, which briefly exposes the proxied appliance API as the Portal Administrator after an administrator session begins. All four affect VSPC 9.2.1.33875 and earlier 9.x builds; the remedy is upgrade to 9.3.0.35057. Veeam's console had a prior critical patch cycle in May for CVE-2026-32998, a separate 9.4‑rated remote code execution bug tied to alarm script execution.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDjango GeoDjango: spatial lookups can write files and enable an admin attack path
Django released 6.0.8 and 5.2.17 on August 4 to address four CVEs. The highest‑rated is CVE-2026-15307 in GeoDjango: spatial lookups accepted str and dict values and passed them to GDALRaster when they appeared to represent rasters. Depending on the raster driver, that could write a file to disk or cause the Django process to issue a network request; writing a file to a location later imported by the application can result in remote code execution.
Crucially, the documented admin attack path requires a staff user with view permission on a registered model containing a spatial field. The fix disallows dict values and strings that are not valid GEOSGeometry values in spatial lookups — a backward‑incompatible change — while direct model‑field assignments continue to accept those types. The release also addresses three lower‑severity issues: CVE-2026-15920 (moderate stored XSS in the admin via unsafe URLField rendering), CVE-2026-15830 (moderate DoS through deeply nested GEOMETRYCOLLECTION objects, now limited to 198 collections), and CVE-2026-15337 (low‑severity memory‑consumption DoS in check_for_language(), now rejecting language codes longer than 500 characters).
Older unsupported branches (including Django 5.1, 5.0, and 4.2) were not evaluated and may be affected. The report notes prior attacker attention to Django GIS code: in February the project patched CVE-2026-1207 (a PostGIS raster SQL injection), and CrowdSec released a detection rule on February 18, observed the first attacks on February 26, and saw continued probing aimed at locating PostGIS‑backed Django deployments.
What this means for operators, hosting firms, and Django site administrators
- Operators running Terraform MCP Server: upgrade to version 1.1.0 or later; if immediate upgrade is impossible, restrict network access to the Streamable HTTP listener and treat MCP session IDs as sensitive values. Confirm whether the deployment uses stateless Streamable HTTP (affected) or stdio (unaffected).
- Hosting firms and managed service providers using Veeam Service Provider Console: upgrade VSPC to 9.3.0.35057. Pay particular attention to builds earlier than 9.2.1.33875 and to the unauthenticated agent‑impersonation vector (CVE-2026-58073) even though its CVSS vector lists high attack complexity.
- Django site administrators and developers using GeoDjango: upgrade to Django 6.0.8 or 5.2.17 and review models that expose spatial fields. Note the backward‑incompatible change to spatial lookups and the documented admin path that requires a staff account with view permission on a registered spatial model.
None of the three advisories says the flaws are under active exploitation; as of August 5, 2026, none of the eleven CVEs appears in CISA's Known Exploited Vulnerabilities catalog, and no public proof‑of‑concept has surfaced. The practical risk therefore depends less on CVSS numbers and more on configuration and exposure: whether a deployment exposes Streamable HTTP, runs a VSPC build before 9.3, or grants staff view permissions on spatial models.
