HashiCorp, Veeam, and the Django Software Foundation have released security updates addressing a total of 11 vulnerabilities affecting Terraform MCP Server, Veeam Service Provider Console, and the Django web framework. Among the issues are three critical flaws that security teams are being urged to address through immediate software updates. The most severe include a CVSS 10.0 cross tenant vulnerability in HashiCorp Terraform MCP Server, a CVSS 9.5 unauthenticated vulnerability in Veeam Service Provider Console that can expose managed agent credentials, and a high severity GeoDjango flaw that could allow file creation on disk and potentially lead to remote code execution under specific conditions. Updated versions are now available, including Terraform MCP Server version 1.1.0 or later, Veeam Service Provider Console version 9.3.0.35057, and Django versions 6.0.8 and 5.2.17. According to the vendors, none of the vulnerabilities have been confirmed as actively exploited, and as of August 5, 2026, none appear in CISA Known Exploited Vulnerabilities catalog.
Veeam addressed four vulnerabilities in Service Provider Console build 9.3.0.35057 through a security bulletin published on August 4 after releasing the update on July 29. The most severe issue, tracked as CVE 2026 58073 with a CVSS score of 9.5, allows an unauthenticated attacker to impersonate a managed agent and obtain its credentials. Although the vulnerability does not require authentication, Veeam noted that successful exploitation involves high attack complexity. Another critical issue, CVE 2026 58072 with a CVSS score of 9.0, allows arbitrary file writing on the management server and could lead to remote code execution when exploited by a low privilege user. The update also resolves CVE 2026 58067, an unauthenticated denial of service vulnerability caused by memory exhaustion, and CVE 2026 58071, which briefly exposes the proxied appliance API with Portal Administrator privileges after an administrator session begins. All four vulnerabilities affect version 9.2.1.33875 and earlier version 9 releases. The latest security update follows another critical patch cycle in May, when Veeam fixed CVE 2026 32998, a remote code execution vulnerability related to alarm script execution.
HashiCorp resolved three vulnerabilities affecting the Streamable HTTP deployment mode of Terraform MCP Server, which connects artificial intelligence assistants with Terraform through the Model Context Protocol. The most serious flaw, CVE 2026 16498, carries a CVSS score of 10.0 and allows cross tenant credential reuse because the underlying MCP library did not generate unique session identifiers in stateless HTTP mode. This could allow one user’s Terraform token to be reused for requests from another user regardless of the credentials provided. Another vulnerability, CVE 2026 16496 with a CVSS score of 8.9, affects the default stateful deployment mode by allowing attackers with another user’s session identifier to access Terraform resources associated with that user’s credentials. The third issue, CVE 2026 14869 with a CVSS score of 8.6, is a server side request forgery vulnerability that may expose configured bearer tokens to attacker controlled endpoints. HashiCorp fixed the vulnerabilities in version 1.1.0 and later released version 1.2.0. The company advised administrators who cannot update immediately to restrict access to the Streamable HTTP listener and treat MCP session identifiers as sensitive information. The company also acknowledged a discrepancy in the documented affected version ranges but confirmed that version 1.1.0 is the first secure release.
The Django Software Foundation released versions 6.0.8 and 5.2.17 to address four security vulnerabilities, including the high severity CVE 2026 15307 affecting GeoDjango. The flaw exists in GeoDjango spatial lookup functionality, where specific string and dictionary values could be processed by GDALRaster, potentially allowing file creation on disk or network requests. Under certain configurations, writing files to locations later imported by the application could result in remote code execution. The documented attack path requires a staff user with view permission for a registered model containing a spatial field. Django resolved the issue by restricting unsupported values in spatial lookups, introducing a backward incompatible change while maintaining support for direct model field assignments. The update also fixes CVE 2026 15920, a stored cross site scripting vulnerability in the administration interface, CVE 2026 15830, a denial of service issue involving deeply nested GEOMETRYCOLLECTION objects, and CVE 2026 15337, a memory consumption denial of service vulnerability in language code processing. Older unsupported branches, including Django 5.1, 5.0, and 4.2, were not evaluated and may also be affected. The release follows earlier security work on Django GIS components, including the February 2026 patch for CVE 2026 1207, a SQL injection vulnerability in PostGIS raster lookups that later attracted exploitation attempts targeting affected deployments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
