A critical credential reuse vulnerability in HashiCorp terraform-mcp-server allows unauthorized users to impersonate others and execute tool calls, compromising tenant isolation.

The software fails to properly isolate credentials in the streamable-HTTP stateless transport mode. This allows an unauthenticated attacker to reuse a session token from one user to execute actions on behalf of another user, violating tenant boundaries.

The CVSS score of 10.0 highlights the extreme severity of this flaw, as it allows for full unauthorized access across tenant boundaries. This could result in complete data exposure, unauthorized modification of infrastructure, and significant reputational damage to organizations relying on the affected software for sensitive operations.

Immediate Action: Update the terraform-mcp-server to version 1.1.0 or later immediately to resolve the credential reuse issue.

Proactive Monitoring: Review audit logs for suspicious tool calls or sessions that appear to originate from incorrect user contexts or unexpected IP addresses.

Compensating Controls: Disable the streamable-HTTP stateless transport mode if the update cannot be applied immediately, as this is the specific vector for the vulnerability.

Public Exploit Available: Unknown

This vulnerability represents a total loss of tenant isolation and must be addressed with the highest priority. Administrators should apply the patch to version 1.1.0 without delay to prevent potential cross-tenant credential abuse.