Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug
16:27 · August 5, 2026 · Hacker News AI Section
HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9.5 A cross-tenant flaw in HashiCorp's MCP server that lets one user's Terraform token be reused for later users'
Summary
HashiCorp, Veeam, and the Django Software Foundation have issued patches addressing eleven vulnerabilities across their respective products, with the most severe involving a CVSS 10.0 cross-tenant isolation failure in the Terraform MCP Server. The server, which enables AI assistants to interact with Terraform through the Model Context Protocol, exposed credentials across users when operated in multi-user Streamable HTTP mode. In stateless configurations the underlying MCP library failed to generate unique session identifiers, allowing one tenant’s cached Terraform token to be reused for subsequent requests regardless of the supplied credentials. A related stateful-mode flaw permitted session-ID reuse to invoke another user’s client, while a third issue enabled server-side request forgery by accepting attacker-controlled addresses through query parameters that bypassed header validation.
Veeam addressed four vulnerabilities in the Service Provider Console, the multi-tenant management interface used by hosting providers to oversee customer backups. Two critical flaws in builds prior to 9.3.0.35057 included an unauthenticated credential exposure rated 9.5 under CVSS 4.0 and a separate unauthenticated memory-exhaustion denial-of-service vector. Additional high-severity issues allowed temporary elevation to Portal Administrator privileges and exposed proxied appliance APIs during administrator session initialization. The fixes apply to all version 9 releases up to 9.2.1.33875; the new build was released on 29 July and detailed in an advisory published 4 August.
Django released versions 6.0.8 and 5.2.17 to correct four issues, one of which received a high severity rating under the project’s own policy. The flaw resided in GeoDjango spatial lookups, which accepted string or dictionary values that could be passed to GDALRaster, potentially resulting in file writes or outbound network requests depending on the raster driver. The documented attack path requires a staff account holding view permission on a model that contains a spatial field. The remaining three vulnerabilities were rated lower; older unsupported branches were not assessed for impact.
None of the advisories report active exploitation, and as of 5 August 2026 none of the CVEs appear in CISA’s Known Exploited Vulnerabilities catalog. Operators are advised to apply the updates promptly, restrict network exposure of the Terraform MCP Server’s HTTP listener where upgrades are delayed, and treat MCP session identifiers as sensitive material.
Why it matters
This article details critical vulnerabilities in infrastructure tools used to deploy and manage AI systems, specifically the Terraform MCP server which connects AI assistants to infrastructure. Security professionals in the Dutch AI market must urgently assess their exposure to prevent cross-tenant credential reuse and potential remote code execution.
