{"vulnerability": "cve-2026-16498", "sightings": [{"uuid": "b6d52545-29a3-4111-b13a-cc30c1c53550", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3msb6zqym2e2u", "content": "Terraform MCP Server Flaw CVE-2026-16498 Scores CVSS 10.0", "creation_timestamp": "2026-08-04T14:12:43.971206Z"}, {"uuid": "2d039c8c-d59b-4ee5-a562-bc229724768f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://t.me/CyberDispatch/2484", "content": "HashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.", "creation_timestamp": "2026-08-30T00:00:37.887304Z"}, {"uuid": "ea88b6a8-59e2-4b65-9ed5-4924896e6270", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://t.me/thehackernews/9717", "content": "\ud83d\udea8 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes.\n\nVeeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE.\n\nHashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.\n\nDjango fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.\n\nSee what needs patching:  https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html", "creation_timestamp": "2026-08-05T15:00:06.267801Z"}, {"uuid": "abb53906-d557-473b-bae2-65883924b90a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://t.me/thehackernews/9717", "content": "\ud83d\udea8 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes.\n\nVeeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE.\n\nHashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.\n\nDjango fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.\n\nSee what needs patching:  https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html", "creation_timestamp": "2026-08-06T00:00:33.745855Z"}, {"uuid": "bb26d445-56f8-4f68-8f57-6ebb45d36775", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://t.me/CyberDispatch/2484", "content": "HashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.", "creation_timestamp": "2026-08-29T20:00:06.311018Z"}, {"uuid": "2cc554a0-bc95-4900-98ed-2f7295dbd318", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrq4tetkat23", "content": "CVE-2026-16498 - tooling\nThe Terraform MCP Server before version 1.1.0 allows one user's credentials to be used by other users. This means that if one user's credentials are compromised, an attacker could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#tooling #hashicorp #CVE #infosec", "creation_timestamp": "2026-07-28T19:18:04.340622Z"}, {"uuid": "9f314c39-5598-4532-93f0-c652c4974cdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mupytk5fa22b", "content": "\u300cTerraform MCP Server\u300d\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027 - \u4fee\u6b63\u7248\u304c\u516c\u958b\n\n\u5916\u90e8\u306e\u30c4\u30fc\u30eb\u304b\u3089\u300cTerraform\u300d\u3092\u64cd\u4f5c\u3059\u308b\u6a5f\u80fd\u3092\u63d0\u4f9b\u3059\u308b\u9023\u643a\u30b5\u30fc\u30d0\u300cTerraform MCP Server\u300d\u306b\u8907\u6570\u306e\u8106\u5f31\u6027\u304c\u660e\u3089\u304b\u3068\u306a\u3063\u305f\u3002\u300c\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u300d\u3068\u3055\u308c\u308b\u8106\u5f31\u6027\u3082\u5224\u660e\u3057\u3066\u304a\u308a\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u63d0\u4f9b\u3055\u308c\u3066\u3044\u308b\u3002\n\nIBM\u5098\u4e0b\u306eHashiCorp\u306f\u73fe\u5730\u6642\u95932026\u5e747\u670828\u65e5\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092\u516c\u958b\u3002MCP\u30b5\u30fc\u30d0\u306e\u300cstreamable-HTTP\u30c8\u30e9\u30f3\u30b9\u30dd\u30fc\u30c8\u300d\u3067\u8a8d\u8a3c\u60c5\u5831\u306e\u518d\u5229\u7528\u3084\u8a8d\u53ef\u56de\u907f\u3001\u30c8\u30fc\u30af\u30f3\u306e\u6f0f\u6d29\u306b\u3064\u306a\u304c\u308b3\u4ef6\u306e\u8106\u5f31\u6027\u300cCVE-2026-16498\u300d\u300cCVE-2026-...", "creation_timestamp": "2026-09-04T22:22:10.251001Z"}]}