HashiCorp, Veeam, and the Django Software Foundation have addressed 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django This article explores 11 vulnerabilities terraform. . The three most serious issues include: - An unauthenticated vulnerability in Veeam's console that exposes managed agent credentials, rated 9.5 - A cross-tenant flaw in HashiCorp's MCP server allowing the reuse of a single Terraform token for subsequent users' requests, scoring maximum 10.0 on its CVE record - A GeoDjango spatial lookup vulnerability that can write to disk and execute code, accessible by staff members with view permissions on registered models containing spatial fields Each version update is now available.
Exposure depends on configuration: HashiCorp's issues affect Streamable HTTP rather than stdio, Veeam's flaws impact versions prior to 9.3, and Django's documented admin attack path requires a staff account with view permission for a model containing a spatial field. Veeam Service Provider Console, the shared interface used by hosting firms and managed service providers to manage customer backups, received four updates in version 9.3.0.35057, announced as part of an August 4 security alert. The update was made available on July 29.
Two other critical issues complete this list: CVE-2026-58067 (__ENTITY_6__), a denial-of-service attack targeting unauthenticated memory exhaustion, and CVE-2026-58071 (__ENTITY_7__), which exposes the proxied appliance's API as Portal Administrator during a brief window after an administrator session starts.
