{"id":2220,"date":"2026-08-05T15:41:11","date_gmt":"2026-08-05T15:41:11","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2220"},"modified":"2026-08-05T15:41:11","modified_gmt":"2026-08-05T15:41:11","slug":"veeam-terraform-mcp-django-patch-critical-flaws-led-by-cvss-10-0-cross-tenant-bug","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2220","title":{"rendered":"Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiGDed_n3TJGLHvhq2MkwkQTsKgIv_rOw24MRfYCoHnHiOK7r-VbitMrwXXF9H_Gwbegba20Dla1FLyK70-OQRVxiHfikBFrz6jei3QK5u4ApbR4aYuLikQj1YHU2IzA1V4fnR7Wgcp8H1NoYzSeTTOUd4dNTuE71jNUNq-P4yk0H9FkW55wivMDdNe0nE\/s1700-e365\/veeam.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django.<\/p>\n<p>The three most serious:<\/p>\n<ul>\n<li>An unauthenticated flaw in Veeam&#8217;s console that hands over a managed agent&#8217;s credentials, rated 9.5<\/li>\n<li>A cross-tenant flaw in HashiCorp&#8217;s MCP server that lets one user&#8217;s Terraform token be reused for later users&#8217; requests, scored a maximum 10.0 on its CVE record<\/li>\n<li>A flaw in GeoDjango&#8217;s spatial lookups that can write a file to disk and, on some setups, run code, reachable by a staff user with view permission on a registered model containing a spatial field<\/li>\n<\/ul>\n<p>Each has a fix available now. Operators should update Terraform MCP Server to version 1.1.0 or later, Veeam Service Provider Console to 9.3.0.35057, and Django to 6.0.8 or 5.2.17.<\/p>\n<p>Exposure is configuration-dependent: HashiCorp&#8217;s bugs affect Streamable HTTP rather than stdio, Veeam&#8217;s flaws affect version 9 builds before 9.3, and Django&#8217;s documented admin attack path requires a staff account with view permission for a model containing a spatial field.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/threatlocker-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh5OTk93vfDmhLLtqoMsx4w59kseqsUysQ92SKB-S2vDoKsMmMfCCkx8AbG5MFzFvZ7rkzKd5LtgOCxlRF2FJ-0FArsVhpOnTMX31VBi9TX-z1Pgv9oSvXiT23KyDlxtVqI0dPRdMIuWc9fbNWgQF8CisKtMme0LpNr79b4wRaeDRxCjfGB8GsxfXa8Ltro\/s728-e100\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>None of the three advisories says the flaws are under active exploitation, and as of August 5, 2026, none of the eleven CVEs appears in CISA&#8217;s Known Exploited Vulnerabilities catalog, and no public proof-of-concept has surfaced.<\/p>\n<p><a name=\"more\"\/><\/p>\n<h2>Impersonate an agent, take its credentials<\/h2>\n<p>Veeam Service Provider Console, the multi-tenant console that hosting firms and managed service providers use to run and monitor customer backups, got four fixes in build 9.3.0.35057, detailed in a <a href=\"https:\/\/www.veeam.com\/kb4893\" target=\"_blank\">security bulletin published August 4<\/a>. Two are critical. Veeam released the build on July 29.<\/p>\n<ul>\n<li>The one to watch is <strong>CVE-2026-58073 <\/strong>(CVSS score: 9.5), which lets an unauthenticated attacker impersonate a managed agent and obtain that agent&#8217;s credentials. Its CVSS vector rates attack complexity as high.<\/li>\n<li>The second critical flaw, <strong>CVE-2026-58072<\/strong> (CVSS score: 9.0), is an arbitrary file write on the management server that can lead to remote code execution and requires a low-privilege account.<\/li>\n<\/ul>\n<p>The 9.5 reads as the worst of the two because it needs no login, but its high attack complexity is the reason the vector is not a straight-line exploit; unauthenticated here does not mean easy.<\/p>\n<p>Two high-severity bugs round out the set:<strong> CVE-2026-58067<\/strong>, an unauthenticated memory-exhaustion denial of service, and <strong>CVE-2026-58071<\/strong>, which exposes the proxied appliance API as Portal Administrator during a short window after an administrator session begins.<\/p>\n<p>All four affect VSPC 9.2.1.33875 and every earlier version 9 build. The fix is the upgrade to 9.3.0.35057.<\/p>\n<p>This is the second critical patch cycle for the console in roughly three months. In May, Veeam fixed <a href=\"https:\/\/www.veeam.com\/kb4853\" target=\"_blank\">CVE-2026-32998<\/a>, a 9.4-rated remote code execution bug tied to alarm script execution.<\/p>\n<h2>One tenant&#8217;s token, reused for the next<\/h2>\n<p>HashiCorp&#8217;s Terraform MCP server, which connects AI assistants to Terraform over the Model Context Protocol, carries three related flaws in its Streamable HTTP transport, <a href=\"https:\/\/discuss.hashicorp.com\/t\/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server\/77606\" target=\"_blank\">disclosed July 28 and fixed in version 1.1.0<\/a>. HashiCorp released the fixed build on July 14, followed by version 1.2.0 on August 4.<\/p>\n<p>Deployments that run only in stdio mode, the local single-user setup, are unaffected. The bugs live in the multi-user HTTP mode meant for centralized, shared deployments, the configuration HashiCorp promoted when it made the server <a href=\"https:\/\/www.hashicorp.com\/en\/blog\/terraform-mcp-server-is-now-generally-available\" target=\"_blank\">generally available in June<\/a>.<\/p>\n<p>The most severe is <strong>CVE-2026-16498<\/strong> (CVSS score: 10.0), a cross-tenant credential-reuse bug in stateless HTTP mode. The underlying MCP library does not assign unique session identifiers, and the server&#8217;s credential cache relied on those identifiers to tell users apart.<\/p>\n<p>One user&#8217;s Terraform token could therefore be reused for later users&#8217; requests regardless of the token they supplied. The root is an assumption about the layer beneath the tool: the server used those session identifiers to keep tenants apart, and in stateless mode the MCP library did not provide unique ones.<\/p>\n<p>A second flaw, <strong>CVE-2026-16496<\/strong> (CVSS score: 8.9), is the stateful-mode version of the isolation failure. Stateful mode is the default when the server runs centrally.<\/p>\n<p>Its cache used the MCP session ID as its sole lookup key, without binding the cached client to the token that created it. That let a user who obtained another user&#8217;s session ID run tool calls with that user&#8217;s Terraform client and reach resources allowed by the victim&#8217;s token.<\/p>\n<p>Juan Pablo Martinez Kuhn of Coinspect reported the flaw; HashiCorp found the other two internally.<\/p>\n<p>The third, <strong>CVE-2026-14869<\/strong> (CVSS score: 8.6), is a server-side request forgery flaw. Request middleware rejected a client-supplied Terraform address when it arrived as an HTTP header but not when the same value came through a query parameter.<\/p>\n<p>An unauthenticated caller able to reach the Streamable HTTP listener could make the server send its configured bearer token to an attacker-controlled endpoint.<\/p>\n<p>Two things complicate reading the CVSS numbers as a priority order. They are not on one scale: Veeam scores on CVSS 4.0 and the HashiCorp records on 3.1, so the 9.5 and the 10.0 are not the same measurement.<\/p>\n<p>And the two isolation flaws land on different configurations: the 10.0 (CVE-2026-16498) affects stateless mode, which an operator has to enable deliberately, while the 8.9 (CVE-2026-16496) affects the stateful mode that is the default for a central deployment.<\/p>\n<p>Which of the two is in reach depends on how the server is configured, not on which carries the higher number.<\/p>\n<p>There is a discrepancy in the published affected-version ranges. HashiCorp&#8217;s umbrella bulletin lists versions 0.2.1 through 1.0.0, while <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-16498\" target=\"_blank\">the individual CVE records<\/a> begin at version 0.3.0. Both sources agree that version 1.1.0 is the first fixed release.<\/p>\n<p>The scores come from the CVE records HashiCorp assigned; the advisory itself lists none. Operators who cannot upgrade immediately should restrict network access to the Streamable HTTP listener to trusted users and treat MCP session IDs as sensitive values.<\/p>\n<h2>Back in GeoDjango&#8217;s raster path<\/h2>\n<p>Django shipped 6.0.8 and 5.2.17 <a href=\"https:\/\/www.djangoproject.com\/weblog\/2026\/aug\/04\/security-releases\/\" target=\"_blank\">on August 4<\/a>, with the same fixes applied to the main branch and the Django 6.1 release-candidate branch. The release covers four CVEs. Django rates their severity under its own security policy, and only one is rated high.<\/p>\n<p>That flaw, <strong>CVE-2026-15307<\/strong>, sits in GeoDjango, the framework&#8217;s geographic-data layer. Spatial lookups accepted str and dict values and passed them to GDALRaster when they appeared to represent rasters.<\/p>\n<p>Depending on the raster driver, that could write a file to disk or make the Django process issue a network request. Writing a file to a location later imported by the application can result in remote code execution.<\/p>\n<p>The documented admin path is reachable by staff users with view permission on a registered model containing a spatial field. The fix disallows dict values and strings that are not valid GEOSGeometry values in spatial lookups, a backward-incompatible change. Direct model-field assignments still accept those types.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The other three flaws are lower severity:<\/p>\n<ul>\n<li>a moderate stored cross-site scripting bug in the admin where unsafe URLField values could be rendered as links and execute when clicked (<strong>CVE-2026-15920<\/strong>);<\/li>\n<li>a moderate denial of service through deeply nested GEOMETRYCOLLECTION objects that could trigger a GEOS segmentation fault (<strong>CVE-2026-15830<\/strong>, now limited to 198 collections); and<\/li>\n<li>a low-severity memory-consumption denial of service in check_for_language() (CVE-2026-15337, now rejecting language codes longer than 500 characters).<\/li>\n<\/ul>\n<p>Older unsupported branches, including Django 5.1, 5.0, and 4.2, were not evaluated and may also be affected.<\/p>\n<p>Django&#8217;s GIS code has already drawn attacker attention this year. In February, the project patched <a href=\"https:\/\/www.djangoproject.com\/weblog\/2026\/feb\/03\/security-releases\/\" target=\"_blank\">CVE-2026-1207<\/a>, a SQL injection flaw in PostGIS raster lookups.<\/p>\n<p>CrowdSec <a href=\"https:\/\/www.crowdsec.net\/vulntracking-report\/cve-2026-1207\" target=\"_blank\">reported exploitation in the wild<\/a>: it released a detection rule on February 18, observed the first attacks on February 26, and subsequently saw steady probing aimed at locating PostGIS-backed Django deployments.<\/p>\n<p>That flaw required a PostGIS backend and user-controlled input to a specific lookup. The probing locates the kind of application without opening it. The new flaw&#8217;s documented route needs a staff account, and fingerprinting a public site does not supply one, so the reconnaissance that found PostGIS-backed Django stops a step short of an actual way in. What carries over is the scrutiny on this code.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam&#8217;s&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2221,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[610,58,561,497,2892,11,1060,765,348,2891,647],"class_list":["post-2220","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-bug","tag-critical","tag-crosstenant","tag-cvss","tag-django","tag-flaws","tag-led","tag-mcp","tag-patch","tag-terraform","tag-veeam"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2220"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2220\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2221"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}