HashiCorp, Veeam, and the Django Software Foundation have released coordinated security updates addressing 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The most severe flaw, a cross-tenant credential reuse bug in HashiCorp's Terraform MCP Server, carries a maximum CVSS 10.0 score and allows one user's Terraform token to be reused for subsequent users' requests in stateless HTTP mode.

Vulnerability Details

Terraform MCP Server: Cross-Tenant Credential Reuse (CVE-2026-16498, CVSS 10.0)

HashiCorp's Terraform MCP Server, which connects AI assistants to Terraform over the Model Context Protocol, contains three related vulnerabilities in its Streamable HTTP transport. The most critical is CVE-2026-16498 (CVSS 10.0), a cross-tenant credential reuse bug affecting stateless HTTP mode.

The root cause lies in the underlying MCP library not assigning unique session identifiers. The server's credential cache relied on these identifiers to isolate tenants, but in stateless mode the MCP library did not provide unique ones. This means one user's Terraform token could be reused for later users' requests regardless of the token they supplied.

Affected versions: 0.3.0 through 1.0.0 (HashiCorp's umbrella bulletin lists 0.2.1 through 1.0.0)
Fixed in: Version 1.1.0 (released July 14, 2026), with version 1.2.0 released August 4, 2026
Configuration impact: Only affects Streamable HTTP mode; stdio mode deployments are unaffected

Two additional flaws accompany the 10.0-rated bug:

• CVE-2026-16496 (CVSS 8.9): Stateful-mode isolation failure. The cache used MCP session ID as its sole lookup key without binding the cached client to the token that created it. A user who obtained another user's session ID could run tool calls with that user's Terraform client.
• CVE-2026-14869 (CVSS 8.6): Server-side request forgery. Request middleware rejected a client-supplied Terraform address when it arrived as an HTTP header but not when the same value came through a query parameter.

Juan Pablo Martinez Kuhn of Coinspect reported the primary flaw; HashiCorp discovered the other two internally.

Veeam Service Provider Console: Unauthenticated Credential Theft (CVE-2026-58073, CVSS 9.5)

Veeam Service Provider Console (VSPC), the multi-tenant console used by hosting firms and managed service providers to run and monitor customer backups, received four fixes in build 9.3.0.35057 released July 29, 2026.

The most severe is CVE-2026-58073 (CVSS 9.5), which allows an unauthenticated attacker to impersonate a managed agent and obtain that agent's credentials. Despite the critical rating, the CVSS vector rates attack complexity as high, meaning unauthenticated does not equate to trivial exploitation.

The second critical flaw, CVE-2026-58072 (CVSS 9.0), is an arbitrary file write on the management server that can lead to remote code execution and requires a low-privilege account.

Two high-severity bugs round out the set:

• CVE-2026-58067: Unauthenticated memory-exhaustion denial of service
• CVE-2026-58071: Exposes the proxied appliance API as Portal Administrator during a short window after an administrator session begins

All four affect VSPC 9.2.1.33875 and every earlier version 9 build. This marks the second critical patch cycle for the console in roughly three months, following the May fix for CVE-2026-32998 (CVSS 9.4), a remote code execution bug tied to alarm script execution.

Django: GeoDjango Spatial Lookup RCE Path (CVE-2026-15307, High Severity)

Django shipped versions 6.0.8 and 5.2.17 on August 4, 2026, addressing four CVEs. The most severe, CVE-2026-15307, sits in GeoDjango, the framework's geographic-data layer.

Spatial lookups accepted str and dict values and passed them to GDALRaster when they appeared to represent rasters. Depending on the raster driver, this could write a file to disk or make the Django process issue a network request. Writing a file to a location later imported by the application can result in remote code execution.

The documented admin attack path is reachable by staff users with view permission on a registered model containing a spatial field. The fix disallows dict values and strings that are not valid GEOSGeometry values in spatial lookups, a backward-incompatible change. Direct model-field assignments still accept those types.

The other three flaws are lower severity:

• CVE-2026-15920: Moderate stored cross-site scripting in the admin where unsafe URLField values could be rendered as links
• CVE-2026-15830: Moderate denial of service through deeply nested GEOMETRYCOLLECTION objects triggering a GEOS segmentation fault (now limited to 198 collections)
• CVE-2026-15337: Low-severity memory-consumption denial of service in check_for_language() (now rejecting language codes longer than 500 characters)

Notably, Django's GIS code has drawn attacker attention this year. In February, the project patched CVE-2026-1207, a SQL injection flaw in PostGIS raster lookups. CrowdSec reported exploitation in the wild, releasing a detection rule on February 18 and observing first attacks on February 26.

Impact Assessment

Who Needs to Act

Terraform MCP Server operators running centralized, shared deployments in Streamable HTTP mode must upgrade immediately. Local single-user stdio deployments are unaffected.

Veeam Service Provider Console users on any version 9 build before 9.3.0.35057 must upgrade. This affects hosting firms and MSPs managing customer backups.

Django developers using GeoDjango with spatial fields and staff users with model view permissions should upgrade to 6.0.8 or 5.2.17 immediately. Older unsupported branches (Django 5.1, 5.0, 4.2) were not evaluated and may also be affected.

Risk Context

None of the three advisories reports active exploitation as of August 5, 2026, and none of the eleven CVEs appears in CISA's Known Exploited Vulnerabilities catalog. No public proof-of-concept exploits have surfaced.

However, the Terraform MCP Server's cross-tenant flaw (CVE-2026-16498) represents a fundamental architectural issue in multi-tenant AI tooling. As organizations adopt MCP servers to connect AI assistants to infrastructure, credential isolation between tenants becomes a critical security boundary.

The Veeam flaws continue a pattern of critical vulnerabilities in backup management consoles, which are high-value targets for ransomware operators seeking to disable recovery capabilities.

Django's recurring GeoDjango issues (CVE-2026-1207 in February, now CVE-2026-15307) signal sustained attacker interest in the framework's geographic data handling code paths.

Mitigation & Patching

Immediate Actions

Terraform MCP Server:

Veeam Service Provider Console:

Django:

Workarounds (If Immediate Patching Not Possible)

Terraform MCP Server: Disable Streamable HTTP mode and use stdio mode only, or restrict the HTTP listener to trusted networks with authentication proxy.

Veeam Service Provider Console: Restrict console access to trusted management networks; monitor for unusual agent registration activity.

Django: Restrict admin access to trusted users; consider removing spatial field view permissions from non-essential staff accounts.

Detection

Indicators of Compromise

Terraform MCP Server:

• Unexpected Terraform operations from service accounts
• Anomalous session ID reuse patterns in logs
• Outbound connections from MCP server to unknown endpoints (SSRF indicator)

Veeam Service Provider Console:

• Unusual agent credential requests from unknown sources
• Memory exhaustion events on management server
• Arbitrary file writes in VSPC installation directories

Django/GeoDjango:

• Unexpected file creation in media/static directories
• GEOS segmentation faults in application logs
• Admin panel access from unusual IPs for spatial model views

Detection Rules

Suricata Rule for Terraform MCP SSRF (CVE-2026-14869):

YARA Rule for Veeam Agent Impersonation (CVE-2026-58073):

Sigma Rule for Django GeoDjango Exploitation (CVE-2026-15307):

Frequently Asked Questions

Q: Does the Terraform MCP Server CVSS 10.0 flaw affect my local development setup? A: No. The cross-tenant credential reuse (CVE-2026-16498) only affects Streamable HTTP mode used for centralized, multi-user deployments. Local stdio mode, the default for individual developers, is unaffected.

Q: Why are there two CVSS scales mentioned (3.1 and 4.0)? A: Veeam scores on CVSS 4.0 while HashiCorp's CVE records use CVSS 3.1. The 9.5 (Veeam) and 10.0 (HashiCorp) are not directly comparable measurements. Evaluate each within its own scoring system.

Q: Is the Django GeoDjango flaw exploitable without a staff account? A: The documented attack path requires a staff account with view permission on a registered model containing a spatial field. However, the underlying GDALRaster handling issue could potentially be reachable through other code paths if your application passes user-controlled data to spatial lookups.

Q: Should I prioritize patching Veeam or Terraform MCP Server first? A: Both are critical. Veeam's CVE-2026-58073 (9.5) is unauthenticated but has high attack complexity. Terraform MCP's CVE-2026-16498 (10.0) is a fundamental architectural flaw in multi-tenant mode. Prioritize based on your exposure: internet-facing VSPC instances vs. centralized MCP server deployments.

Q: Are there any known exploit kits or ransomware campaigns using these flaws? A: As of August 5, 2026, none of the eleven CVEs appears in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept exploits have been reported. However, the Veeam and Django GIS code have historical exploitation precedent.

Key Takeaways

1. Three major developer tooling projects released coordinated patches on August 4-5, 2026, addressing 11 vulnerabilities total
2. Terraform MCP Server's CVSS 10.0 cross-tenant bug (CVE-2026-16498) is the most severe, exposing a fundamental credential isolation failure in multi-tenant AI infrastructure tooling
3. Veeam Service Provider Console continues to be a high-value target with its second critical patch cycle in three months (CVE-2026-58073, CVSS 9.5)
4. Django's GeoDjango layer shows recurring vulnerability patterns (CVE-2026-1207 in Feb, CVE-2026-15307 now), indicating sustained attacker focus
5. No active exploitation reported as of publication, but the architectural nature of the MCP flaw warrants immediate attention for centralized deployments
6. Configuration matters critically: Streamable HTTP vs stdio mode, VSPC version 9 builds, Django staff permissions -- understand your deployment topology before prioritizing

Conclusion

This coordinated disclosure highlights the expanding attack surface where AI tooling (MCP servers), infrastructure management (Veeam), and web frameworks (Django) intersect. The Terraform MCP Server flaw is particularly significant as it reveals a credential isolation gap in the emerging Model Context Protocol ecosystem -- a reminder that as AI assistants gain infrastructure access, the security boundaries between tenants must be explicitly engineered, not assumed.

Operators of affected systems should prioritize upgrades this week. For Terraform MCP Server, the distinction between stateless (10.0) and stateful (8.9) mode vulnerabilities means your deployment architecture determines which flaw is reachable -- not the CVSS number alone.

---

Sources:

• The Hacker News: Veeam, Terraform MCP, Django Patch Critical Flaws
• HashiCorp Security Bulletin HCSEC-2026-23
• Veeam KB4893: VSPC Security Bulletin
• Django Security Releases: August 4, 2026
• CVE-2026-16498 Record
• CVE-2026-58073 Record
• CVE-2026-15307 Record