Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug

Three vendors patched a total of 11 vulnerabilities across their products:

1. VEEAM SERVICE PROVIDER CONSOLE (VSPC): Four vulnerabilities fixed in build 9.3.0.35057 (released July 29, 2026). CVE-2026-58073 (CVSS 9.5, CVSS 4.0): Unauthenticated attacker can impersonate a managed agent and obtain that agent's credentials; attack complexity is rated high. CVE-2026-58072 (CVSS 9.0): Arbitrary file write on the management server leading to remote code execution, requires a low-privilege account. CVE-2026-58067: Unauthenticated memory-exhaustion denial of service. CVE-2026-58071: Exposes the proxied appliance API as Portal Administrator during a short window after an administrator session begins. All four affect VSPC 9.2.1.33875 and all earlier version 9 builds.

2. HASHICORP TERRAFORM MCP SERVER: Three related flaws in the Streamable HTTP transport, disclosed July 28 and fixed in version 1.1.0 (released July 14, 2026). Only deployments using Streamable HTTP (multi-user HTTP mode) are affected; stdio mode (local single-user) is unaffected. CVE-2026-16498 (CVSS 3.1: 10.0): Cross-tenant credential-reuse bug in stateless HTTP mode. The MCP library does not assign unique session identifiers, and the server's credential cache relied on those identifiers to distinguish users. One user's Terraform token could be reused for later users' requests regardless of the token they supplied. CVE-2026-16496 (CVSS 3.1: 8.9): Stateful-mode isolation failure (default for central deployments). Cache used MCP session ID as sole lookup key without binding the cached client to the token that created it, allowing a user with another user's session ID to run tool calls with that user's Terraform client. CVE-2026-14869 (CVSS 3.1: 8.6): Server-side request forgery (SSRF). Request middleware rejected a client-supplied Terraform address when sent as an HTTP header but not when sent as a query parameter, allowing an unauthenticated caller to make the server send its configured bearer token to an attacker-controlled endpoint. Affected versions: 0.2.1 (or 0.3.0 per individual CVE records) through 1.0.0.

3. DJANGO: Four CVEs fixed in versions 6.0.8 and 5.2.17 (released August 4, 2026). CVE-2026-15307 (High): GeoDjango flaw where spatial lookups accepted str and dict values passed to GDALRaster when they appeared to represent rasters. Depending on the raster driver, this could write a file to disk or make Django issue a network request; writing to a location later imported by the application can result in RCE. Requires a staff account with view permission on a registered model containing a spatial field. Fix disallows dict values and strings that are not valid GEOSGeometry values in spatial lookups (backward-incompatible change). CVE-2026-15920 (Moderate): Stored XSS in the admin where unsafe URLField values could be rendered as links and execute when clicked. CVE-2026-15830 (Moderate): DoS through deeply nested GEOMETRYCOLLECTION objects triggering a GEOS segmentation fault; now limited to 198 collections. CVE-2026-15337 (Low): Memory-consumption DoS in check_for_language(); now rejecting language codes longer than 500 characters. Note: CVSS scoring scales differ — Veeam uses CVSS 4.0, HashiCorp uses CVSS 3.1, so scores are not directly comparable. None of the 11 CVEs are in CISA's KEV catalog as of August 5, 2026, and no public proof-of-concept has surfaced.