Veeam, Terraform MCP and Django issue security fixes

Eleven vulnerabilities receive fixes across three products

Veeam, HashiCorp and the Django Software Foundation have issued fixes for 11 vulnerabilities affecting Veeam Service Provider Console, Terraform MCP Server and Django. The most severe disclosed issue is CVE-2026-16498, rated CVSS 10.0, in Terraform MCP Server’s Streamable HTTP transport. It can cause one tenant’s Terraform token to be reused for later users’ requests in stateless HTTP mode.

Operators are advised to update Terraform MCP Server to version 1.1.0 or later, Veeam Service Provider Console to build 9.3.0.35057, and Django to versions 6.0.8 or 5.2.17. None of the advisories says these vulnerabilities are under active exploitation, and none of the 11 CVEs appeared in CISA’s Known Exploited Vulnerabilities catalog as of August 5, 2026.

Terraform MCP flaws affect shared HTTP deployments

HashiCorp fixed three related flaws in Terraform MCP Server version 1.1.0. The issues affect Streamable HTTP, rather than the local single-user stdio mode. CVE-2026-16498 stems from the MCP library not assigning unique session identifiers in stateless mode, while the server’s credential cache used those identifiers to distinguish users.

The result is cross-tenant credential reuse: a Terraform token from one user can be applied to subsequent requests regardless of the token presented by those users. A separate stateful-mode issue, CVE-2026-16496, scored 8.9 and can allow tool calls with another user’s Terraform client if an attacker obtains that user’s session ID. CVE-2026-14869, rated 8.6, permits server-side request forgery through a Terraform address supplied as a query parameter.

For organizations assessing shared AI tooling, borrowed trust in cybersecurity shows why trust boundaries deserve the same scrutiny as authentication controls, especially when a cache or session value separates tenants. HashiCorp recommends restricting network access to Streamable HTTP listeners to trusted users where an immediate upgrade is not possible and treating MCP session IDs as sensitive values.

Veeam and Django patches address distinct exposure paths

Veeam’s build 9.3.0.35057 resolves four flaws in Veeam Service Provider Console. CVE-2026-58073, rated 9.5 under CVSS 4.0, lets an unauthenticated attacker impersonate a managed agent and obtain its credentials, although its vector assigns high attack complexity. CVE-2026-58072, rated 9.0, is an arbitrary file-write flaw on the management server that can lead to remote code execution and requires a low-privilege account.

All four Veeam issues affect version 9.2.1.33875 and earlier version 9 builds. The remaining fixes address an unauthenticated memory-exhaustion denial of service and temporary exposure of a proxied appliance API as Portal Administrator after an administrator session starts.

Django 6.0.8 and 5.2.17 fix four CVEs, including CVE-2026-15307 in GeoDjango spatial lookups. Certain raster-like values could lead, depending on the raster driver, to a disk write or a network request; a file written to a location later imported by an application can result in remote code execution. The documented admin route requires a staff account with view permission on a registered model containing a spatial field.

The practical priority is configuration-led patching: identify Veeam version 9 consoles, determine whether Terraform MCP uses Streamable HTTP and which mode it runs, and review Django deployments using GeoDjango administration. Applying the available releases and limiting exposed shared listeners reduces the stated attack paths.