Patches for Veeam, Terraform MCP and Django: The Big Hole Is Cross-Tenant, at CVSS 10.0

HashiCorp, Veeam and the Django Software Foundation simultaneously released fixes for a total of 11 vulnerabilities in Terraform MCP Server, Veeam Service Provider Console and the Django web framework. Three of them stand out, and all have already been closed in the latest builds.

Someone Else's Token for the Next User

The loudest of them is CVE-2026-16498, rated a maximum 10.0, in Terraform MCP Server — the server that ties AI assistants to Terraform over the Model Context Protocol. In stateless mode, the underlying MCP library failed to issue unique session identifiers, yet the credential cache relied on them to tell users apart. As a result, one client's token could be reused in another's requests — regardless of which token they actually presented.

All told, the server has three related flaws, all of them affecting the Streamable HTTP transport; the local single-user stdio mode is unaffected. Interestingly, you can't read the CVSS scores here as an order of priority: the 10.0 bug only triggers in stateless mode, which an administrator has to deliberately enable, whereas CVE-2026-16496 (8.9) hits stateful mode — the very one that is the default in a centralized deployment. You should upgrade to version 1.1.0 or later.

Impersonate an Agent and Grab Its Password

In Veeam Service Provider Console — the multi-tenant console for hosters and service providers — four bugs have been closed, two of them critical. CVE-2026-58073 (9.5) lets an unauthenticated attacker impersonate a managed agent and obtain its credentials. That said, the vector notes a high attack complexity: “unauthenticated” does not mean “easy” here. The second critical one, CVE-2026-58072 (9.0), is an arbitrary file write on the management server leading to remote code execution. The remedy is an upgrade to build 9.3.0.35057. This is already the second critical patch cycle for the console in roughly three months.

The GeoDjango Raster Path Again

Django released versions 6.0.8 and 5.2.17, closing four CVEs. The only “high” one is CVE-2026-15307 in GeoDjango: spatial queries accepted str and dict values and passed them to GDALRaster, which — depending on the driver — could write a file to disk or make the process issue a network request, and a write to the right place could lead to code execution. The documented path through the admin requires a staff account with view permission on a model containing a spatial field.

As of August 5, 2026, none of the eleven vulnerabilities is listed in the CISA catalog as exploited, and there are no public PoCs yet. Even so, Django's GIS code has already drawn attackers' attention: in February a SQL injection in PostGIS raster queries was fixed, and CrowdSec logged real-world attacks. Reconnaissance that finds such deployments doesn't lead straight to the new bug — but the close scrutiny of this code hasn't gone anywhere.

Source: The Hacker News