Terraform vulnerabilities and fixes

CVEs that mention Terraform, ranked by priority. 6 tracked.

Terraform has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-10-22. Highest priority: CVE-2026-16498 (score 53/100).

• CVE-2026-16498 CRITICAL 10.0 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the st
• CVE-2026-115414 HIGH 7.8 OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influenc
• CVE-2026-14869 HIGH 8.6 The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the stre
• CVE-2026-16496 HIGH 8.9 The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP
• CVE-2026-65924 MEDIUM 6.5 UPGRADE JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request
• CVE-2026-71477 MEDIUM 6.7 mise manages dev tools like node, python, cmake, and terraform

FAQ

How do I fix Terraform vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Terraform being exploited right now?

None of the tracked Terraform CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Terraform CVE should I patch first?

CVE-2026-16498 currently ranks highest (53/100): The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the st.

← Back to latest CVEs