HashiCorp Terraform MCP Server is affected by a session fixation vulnerability that could allow unauthorized access to authenticated user sessions.

This is a session fixation vulnerability (CWE-384) where the application fails to properly regenerate or invalidate session identifiers upon authentication. The attack vector is remote and requires high complexity to execute, but it does not require prior authentication.

A session fixation attack can result in the total compromise of user accounts, enabling attackers to gain unauthorized access to sensitive infrastructure management tools. Given the CVSS score of 8.9, this vulnerability represents a critical threat to internal security and administrative control over HashiCorp-managed environments.

Immediate Action: Upgrade to the latest version of the Terraform MCP server that includes the fix for session handling as documented in the vendor advisory.

Proactive Monitoring: Review authentication logs and session management patterns for anomalies, such as multiple users sharing the same session identifier.

Compensating Controls: Ensure that all sessions are terminated and re-issued upon login and enforce short session timeouts to limit the window of opportunity for an attacker.

Public Exploit Available: No confirmed public exploit available.

Security teams should treat this vulnerability with urgency due to the potential for administrative account takeover. It is recommended to apply the vendor-provided patch immediately and audit current session management configurations to ensure compliance with secure development practices.