A critical SSRF vulnerability in HashiCorp Terraform MCP Server exposes internal network infrastructure to unauthorized request manipulation.

The application is vulnerable to Server-Side Request Forgery (SSRF), allowing an unauthenticated attacker to manipulate the server into making requests to unauthorized or internal network locations.

SSRF vulnerabilities can be used to bypass internal firewalls, scan internal networks, or interact with sensitive metadata services. With a CVSS score of 8.6, the risk of lateral movement or information disclosure within the environment is high.

Immediate Action: Upgrade to version 1.1.0 or later as recommended by HashiCorp to mitigate this SSRF risk.

Proactive Monitoring: Monitor server outbound traffic for connections to internal IP ranges or services that the Terraform MCP Server should not be accessing.

Compensating Controls: Implement strict egress filtering on the server to prevent it from initiating requests to sensitive internal endpoints or metadata services.

Public Exploit Available: Unknown.

Organizations should prioritize the update to version 1.1.0 to ensure the vulnerability is fully remediated. Given the potential for internal network discovery and unauthorized access, immediate patching is recommended to secure the environment against potential SSRF exploitation.