ANALYSIS · 3c9e7c2c· FINISHED 2026-08-06 · PATCHDIFF

terraform-mcp-serverv1.0.0 → v1.1.0✓ COMPLETED

Files14

Vulnerable9

True positives8

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-16496

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 14 CVE 1 Vuln 9

SORT

1 files · page 1/1

pkg/client/registry_client.go

AI: 1 vulnerabilities

CVE-2026-16496 1 TP

#%!d(float64=009)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-16496

Security writeup for CVE-2026-16496

✓ 1 FILE

## The Exploit

An unauthenticated attacker who has obtained another user's MCP session ID (e.g., from logs, network sniffing, or prior session theft) can replay that session ID to perform arbitrary Terraform operations with the victim's privileges.

```bash
# Attacker replays a stolen session ID to execute a Terraform tool call
curl -X POST https://target-server:port/mcp/streamable-http \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer iamvictim-session-id-12345" \
  -d '{
    "method": "tools/call",
    "params": {
      "name": "terraform_init",
      "arguments": {}
    },
    "id": 1
  }'
```

When the attacker sends this request, the server processes it as if the victim had initiated the command. The attacker observes a successful response with the Terraform state output, including access to sensitive infrastructure data and the ability to run destructive operations like `terraform destroy`.

## What the Patch Did

**Before** (pkg/client/registry_client.go, line 25):
```go
logger.WithField("session_id", sessionId).Info("Created HTTP client")
```

**After** (pkg/client/registry_client.go, line 25):
```go
logger.Info("Created HTTP client")
```

The patch removes the `session_id` field from the log entry entirely. Instead of exposing the session ID as a structured log field where it could be captured by centralized logging systems or accessible to unauthorized users, the fix simply logs that an HTTP client was created without any identifying session context. This is a data minimization fix applied at the logging sink—the engineer removed the sensitive identifier from being recorded at all, rather than attempting to encrypt or hash it.

## Root Cause

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The dataflow is straightforward: when the terraform-mcp-server creates an HTTP client for a given user's session, it logs the session ID—a secret token that authenticates the user's MCP session—into a structured log entry. Any downstream log aggregation tool, web server log viewer, or monitoring dashboard that exposes these logs allows an attacker to extract valid session IDs. The attacker then uses that session ID in the `Authorization: Bearer <session_id>` header to impersonate the victim. The vulnerability is that a high-entropy credential (the session ID) is treated as metadata rather than a secret, and is written to log output where it bypasses all access control boundaries. There is no encryption, hashing, or redaction applied to the session ID before logging.

## Why It Works

The single load-bearing line is the entire `WithField("session_id", sessionId)` call. If that line were reverted, the bug would be completely un-exploitable—no session ID would appear in any log output. The engineer wrote only one new line (the trimmed call) and removed one line. However, the fix is minimal in the wrong dimension. A defense-in-depth approach would also have added:

1. A log sanitizer that strips known secret patterns before writing.
2. A session ID validation check that rejects requests not matching the current transport-level authentication token.
3. Rate limiting on the MCP endpoint to slow down brute-force guessing of session IDs.

The engineer chose the simplest possible fix—stop logging the secret—which works perfectly against this specific leak vector but does nothing to protect against other points where the session ID might be exposed (error messages, debug pages, or other log contexts).

## Hardening Checklist

- Use `Logger.WithSensitiveField()` or a custom logging wrapper that automatically redacts fields matching a secret pattern (e.g., regex for `session_id`, `token`, `password`) before calling the logging backend.
- Enforce **short-lived MCP session tokens** with a maximum TTL of 15 minutes, and rotate them automatically on each new streamable-HTTP connection.
- Implement a **source IP pinning** check: for each session ID, record the originating IP address at creation time and reject any request using that session ID from a different IP, unless explicitly allowed by the configuration.
- Add **rate limiting** (e.g., 5 consecutive failed session ID guesses triggers a 10-second global lockout) to the streamable-HTTP endpoint using `golang.org/x/time/rate` or similar middleware.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-16496

CVE CVE-2026-16496

PRODUCT terraform-mcp-server

AFFECTED ≤ v1.0.0

FIXED IN v1.1.0

STATUS Generated

Security writeup · CVE-2026-16496

Source files · 1

pkg/client/registry_client.go Linked

↗ NVD