Approved changes feed: RSS · Atom
cpe:2.3:a:hashicorp:tooling:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hashicorp (dc524c16-6a01-528e-a41c-9d3e02e5e4a3) |
|---|---|
| Product | Tooling (041ce156-3db2-529a-abe0-bd0e99af0355) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14869 |
vulnerable | 2026-09-16 04:33:12.372234 |
terraform-mcp-server vulnerable to server side request forgery leading to token exposure
HIGH (8.6)
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.
Published: 2026-07-28T17:53:58.707Z
Updated: 2026-07-28T19:19:31.237Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87993 |
vulnerable | 2026-09-16 04:33:01.162479 |
Consul-template vulnerable to an information disclosure issue in error handling
HIGH (7.7)
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.
Published: 2026-09-10T19:00:08.728Z
Updated: 2026-09-10T19:21:18.274Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16498 |
vulnerable | 2026-09-16 04:32:57.134291 |
terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
CRITICAL (10)
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.
Published: 2026-07-28T17:57:45.748Z
Updated: 2026-07-28T18:39:15.712Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16328 |
vulnerable | 2026-09-16 04:32:56.965586 |
consul-mcp-server vulnerable to server side request forgery leading to token exposure
HIGH (8.6)
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This vulnerability, CVE-2026-16328, is fixed in consul-mcp-server 0.1.4.
Published: 2026-07-29T18:32:39.870Z
Updated: 2026-07-29T19:11:05.959Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16326 |
vulnerable | 2026-09-16 04:32:56.514066 |
consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
CRITICAL (10)
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
Published: 2026-07-29T18:40:08.796Z
Updated: 2026-07-29T19:10:11.027Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16496 |
vulnerable | 2026-09-16 04:32:56.386911 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14361 |
vulnerable | 2026-07-29 00:26:16.953777 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5061 |
vulnerable | 2026-06-08 08:07:02.948644 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4660 |
vulnerable | 2026-06-08 08:05:13.651577 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1293 |
vulnerable | 2026-06-08 07:08:36.267339 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13357 |
vulnerable | 2026-06-08 07:04:32.050258 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.