HashiCorp, Veeam, and the Django Software Foundation have addressed critical vulnerabilities in their platforms, urging users to implement fixes immediately. These updates target Terraform MCP Server, Veeam Service Provider Console, and Django, addressing severe security flaws.
Major Security Flaws Identified
The most critical vulnerability, identified in HashiCorp’s Terraform MCP server, is a cross-tenant issue that allows credential reuse, achieving a perfect 10.0 CVSS score. In Veeam’s console, an unauthenticated flaw rated 9.5 permits access to managed agent credentials. Django’s GeoDjango component also faced a significant flaw enabling unauthorized file writing and potential code execution.
Updates are now available. Operators should upgrade Terraform MCP Server to version 1.1.0 or later, Veeam Service Provider Console to 9.3.0.35057, and Django to 6.0.8 or 5.2.17.
Configuration-Dependent Exposure
The impact of these vulnerabilities depends on specific configurations. HashiCorp’s bugs affect Streamable HTTP but not stdio, while Veeam’s issues concern version 9 builds prior to 9.3. Django’s flaw requires a staff account with view permission on models containing spatial fields.
Despite the severity, none of these vulnerabilities are known to be exploited in the wild as of August 5, 2026, and they do not appear in CISA’s Known Exploited Vulnerabilities catalog.
Details of the Vulnerabilities
Veeam’s Service Provider Console, a tool for managing customer backups, released fixes for four vulnerabilities in build 9.3.0.35057. Among them, CVE-2026-58073 allows unauthorized access to agent credentials, while CVE-2026-58072 can lead to remote code execution via arbitrary file writes.
HashiCorp’s Terraform MCP server carried flaws within its Streamable HTTP transport. The most severe, CVE-2026-16498, allows cross-tenant credential reuse due to a lack of unique session identifiers in stateless mode.
Django’s GeoDjango flaw, CVE-2026-15307, involves spatial lookups that can write files to disk, potentially leading to remote code execution. The fix restricts invalid input types in spatial lookups.
The urgency to patch these vulnerabilities highlights the ongoing need for organizations to maintain updated software and configurations to prevent cyber threats.
