Full research report
Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug
Executive assessment
This disclosure covers eleven vulnerabilities across three distinct and widely-deployed product lines with no evidence of current exploitation, but the operational stakes differ significantly per product. The Veeam VSPC flaws pose the most immediate risk to infrastructure: managed service providers running version 9.2 face two critical unauthenticated or near-unauthenticated flaws on a platform that controls customer backup estates, and Veeam's pattern of critical VSPC patches – a 9.4-rated RCE in May 2026 followed by a 9.5 and 9.0 in August – suggests sustained researcher interest in this attack surface. The CVSS 10.0 Terraform MCP Server flaw carries architectural significance beyond its CVSS score: it is rooted in a design assumption error about session-identifier uniqueness in an underlying MCP library, a dependency-layer trust failure that may affect other tools built on the same library. Django's CVE-2026-15307 has a constrained attack surface in practice – requiring a staff account with spatial-field model access – but the file-write-to-code-execution consequence is severe if that pre-condition is met, particularly in shared or multi-tenant Django deployments. The primary defensive priority for all three products is straightforward patching, as all three vendors have released fixes and none of the attack paths has a viable workaround comparable to the patch.
What happened
On 4–5 August 2026, HashiCorp, Veeam, and the Django Software Foundation disclosed eleven vulnerabilities across three products. Veeam's advisory was published on 4 August, following a patch build quietly released on 29 July; the HashiCorp advisory had been issued on 28 July with a fix available since 14 July; Django's advisory and patch were released simultaneously on 4 August. CVE-2026-32998, cited in the source article, is a separate 9.4-rated Veeam RCE patched in May 2026 and provided only as historical context; it is not part of this disclosure cycle.
Affected scope
Veeam Service Provider Console versions 9.2.1.33875 and all earlier version-9 builds, used by managed service providers and hosting firms. HashiCorp Terraform MCP Server versions 0.2.1 through 1.0.0 (NVD states 0.3.0; see uncertainties) when deployed in Streamable HTTP mode; stdio-mode deployments are unaffected. Django 5.2.x before 5.2.17 and 6.0.x before 6.0.8 when GeoDjango is enabled and spatial-field models are registered in the admin.
Technical assessment
The highest-severity flaw, CVE-2026-16498 (CVSS 3.1: 10.0), arises because the Terraform MCP Server's credential cache relied on MCP session identifiers for tenant isolation, but the underlying MCP library does not produce unique session identifiers in stateless HTTP mode; one tenant's token could therefore be applied to subsequent requests by any other user. CVE-2026-58073 (CVSS 4.0: 9.5) in Veeam VSPC allows an unauthenticated caller to impersonate a managed backup node and retrieve its stored credentials; the high attack-complexity rating in the CVSS vector indicates non-trivial pre-conditions. CVE-2026-15307 in Django permits a staff user with view-only permission on a model containing a spatial field to supply crafted lookup values that the GDAL library interprets as raster paths, potentially writing files to disk or issuing outbound network requests. Note that Veeam scores on CVSS 4.0 and HashiCorp on CVSS 3.1, so numerical scores across these products are not directly comparable.
Recommended defensive actions
- Upgrade Veeam Service Provider Console to build 9.3.0.35057 immediately; Veeam documents no workaround for CVE-2026-58073 or CVE-2026-58072.
- Upgrade Terraform MCP Server to version 1.1.0 or later; if an immediate upgrade is not feasible, restrict the deployment to stdio mode or isolate the Streamable HTTP listener from untrusted networks at the network boundary.
- Upgrade Django to 6.0.8 or 5.2.17; if the upgrade must be deferred, restrict admin access so that no untrusted staff account holds view permission on models containing spatial fields.
- Monitor Veeam VSPC management server logs for unexpected file-creation events and anomalous backup-node authentication patterns, which may indicate attempted exploitation of CVE-2026-58072 or CVE-2026-58073.
- Subscribe to the CISA KEV catalogue and vendor security mailing lists so that any addition of these CVEs – which would signal confirmed in-the-wild exploitation – triggers an immediate escalation response.
Uncertainties and evidence gaps
- The precise attack-complexity pre-conditions that make CVE-2026-58073 exploitable have not been publicly described by Veeam beyond the CVSS vector notation.
- A minor version-range discrepancy exists between the NVD record for CVE-2026-16498 (which states 0.3.0 as the lower bound) and the HashiCorp security bulletin (which states 0.2.1); NVD enrichment was incomplete at the time of research.
- No independent researcher has publicly confirmed the complete exploitation path for CVE-2026-15307, and the advisory does not enumerate which GDAL raster drivers are required for the file-write impact to materialise.
- The Veeam patch build was released on 29 July, roughly six days before the public advisory; it is unclear whether customers were notified privately during this window or whether the pre-announcement release created an unguided patching gap.
- The supplied reporting identifies CVE-2026-14869, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-16496, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-58067, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-58071, but the reviewed sources did not establish its distinct role in this event.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No active exploitation confirmed as of 5 August 2026; none of these CVEs appears in the CISA Known Exploited Vulnerabilities catalogue and no public proof-of-concept code has been identified.
The investigation began by fetching the source article to extract CVEs and vendor advisory links, then verified each advisory directly against three independent primary-source domains. CISA KEV searches returned no matches for any of the eleven CVEs, corroborating all three vendors' stated positions that exploitation has not been observed. No public proof-of-concept was found across any search, and the investigation identified one factual uncertainty – a minor version-range discrepancy between the NVD record and the HashiCorp bulletin for CVE-2026-16498 – worth flagging for defenders.
- What CVEs, affected products, and vendor advisory links does the source article identify?Fetched the Hacker News source articlethehackernews.com ↗
Confirmed eleven CVEs across three products; extracted advisory URLs for Veeam (KB4893), HashiCorp (HCSEC-2026-23), and Django (djangoproject.com weblog); noted that CVE-2026-32998 is presented only as historical context from a May 2026 patch cycle.
why Established the full scope of the story and provided leads for primary-source verification, while flagging the historical CVE to avoid inflating the active disclosure count.
- Do the three HashiCorp Terraform MCP CVEs have independent search coverage and corroboration beyond the article?Searched for CVE-2026-14869, CVE-2026-16496, and CVE-2026-16498 together with HashiCorp and Terraform MCP Server
Found the HashiCorp Discuss bulletin HCSEC-2026-23, NVD entries, and independent security-outlet coverage; confirmed affected range 0.2.1–1.0.0, fix in 1.1.0, and researcher credit to Juan Pablo Martinez Kuhn of Coinspect for CVE-2026-16496.
why Multiple independent domains covering the same event raises confidence in the article's HashiCorp claims before direct advisory verification.
- Do the Veeam VSPC CVEs have corroborating search coverage?Searched for CVE-2026-58073 and CVE-2026-58072 alongside the advisory reference KB4893
Found the Veeam KB4893 URL, independent Belgian CERT advisory, and security news coverage; confirmed CVSS 4.0 scores and the patch build number from multiple outlets.
why A government CERT advisory (CCB Belgium) independently referencing the same CVEs and patch is strong corroboration prior to fetching the vendor page.
- Does the Veeam KB4893 advisory confirm CVE details, scores, and affected versions?Fetched the Veeam KB4893 advisory pageveeam.com ↗
Confirmed: CVE-2026-58073 (CVSS 4.0: 9.5), CVE-2026-58072 (CVSS 4.0: 9.0), CVE-2026-58067 (CVSS 4.0: 8.7), CVE-2026-58071 (CVSS 4.0: 8.2); affected scope is VSPC 9.2.1.33875 and all earlier version-9 builds; fix is 9.3.0.35057; CVE-2026-58073 and CVE-2026-58072 were reported via HackerOne.
why Primary vendor source confirms all article claims; HackerOne disclosure pathway confirms coordinated responsible disclosure.
- Does the HashiCorp security bulletin confirm CVE details and the fixed version?Fetched HCSEC-2026-23 on HashiCorp Discussdiscuss.hashicorp.com ↗
Confirmed: affected versions 0.2.1–1.0.0, fix in 1.1.0, public disclosure 28 July 2026; CVE-2026-14869 is SSRF via query-parameter bypass of middleware, CVE-2026-16496 is stateful-mode session-isolation failure, CVE-2026-16498 is stateless-mode cross-tenant token reuse.
why Primary vendor source fully corroborates article claims; the absence of any exploitation note in the bulletin is consistent with the article's exploitation assessment.
- Does the Django Foundation advisory confirm the CVEs and patch details?Fetched the Django Security Foundation advisory weblog postdjangoproject.com ↗
Confirmed four CVEs: CVE-2026-15307 (High – file-write/SSRF via spatial lookups), CVE-2026-15337 (Low – DoS in language check), CVE-2026-15830 (Moderate – geometry-collection DoS), CVE-2026-15920 (Moderate – admin XSS); all fixed in Django 5.2.17 and 6.0.8 released 4 August 2026.
why Primary vendor source confirms the three additional Django CVEs not listed in the assignment prompt, raising the confirmed total to eleven; no exploitation reported.
- What does NVD report for CVE-2026-16498, the CVSS 10.0 flaw?Fetched the NVD detail page for CVE-2026-16498nvd.nist.gov ↗
CVSS 10.0 confirmed via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L; CWE-488 (Exposure of Data Element to Wrong Session); affected versions listed as 0.3.0 through pre-1.1.0, a minor discrepancy versus the HashiCorp bulletin's stated lower bound of 0.2.1; NVD enrichment marked incomplete.
why Independent government database confirms the maximum CVSS score; the version-range discrepancy is a material uncertainty for defenders deciding which deployments are in scope.
- Have any of these CVEs been added to the CISA Known Exploited Vulnerabilities catalogue?Searched for CISA KEV catalogue additions mentioning the story's CVEs
No search result places CVE-2026-58073, CVE-2026-16498, CVE-2026-15307, or any of the eleven CVEs in the CISA KEV catalogue; August 2026 KEV additions reference entirely unrelated vulnerabilities.
why Absence from KEV, across multiple results pages, corroborates the three vendors' own statements that exploitation has not been observed in the wild.
- Is any public proof-of-concept or exploit code available for any of these CVEs?Searched for proof-of-concept, technical write-up, or exploit code for CVE-2026-15307 and the broader patch set
No public proof-of-concept or exploit code found across all results; coverage is exclusively vendor advisories and security news reporting with no technical reproduction detail.
why Absence of public PoC reduces near-term exploitation risk and confirms the 'no PoC' assessment; however, the advisory detail already published is sufficient to guide reverse engineering, so the risk window is narrowing.
Research coverage
All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (1 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| NVDcve | ok900 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1661 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok672 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1007 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| FIRST EPSSepss | ok7492 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 4 opened outside the registered collection
Vendor & gov advisories3
Primary Veeam advisory covering all four VSPC CVEs; confirms patch build 9.3.0.35057, affected scope, and HackerOne responsible-disclosure credit.
HashiCorp's security bulletin for all three Terraform MCP CVEs; confirms fix in 1.1.0 and researcher credit to Juan Pablo Martinez Kuhn of Coinspect for CVE-2026-16496.
Official Django Software Foundation advisory covering four CVEs; confirms CVE-2026-15307 as the highest-severity issue.
Analysis & research1
Confirms CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L), CWE-488, and affected version range; NVD enrichment was still in progress at time of research.