CVE Tools
Track your stack

Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug

The Hacker NewsBy The Hacker News

PatchVeeam Service Provider ConsoleTerraform MCP Server

Our summary

Vendors Veeam, HashiCorp, and the Django Software Foundation have issued patches for 11 critical vulnerabilities across their products. Among these, a high-risk cross-tenant issue in HashiCorp’s Terraform MCP Server received a maximum CVSS score of 10.0. Other notable flaws include an unauthenticated credential-extraction bug in Veeam Service Provider Console (CVE-2026-58073, CVSS 9.5) and a potentially exploitable file-write vulnerability in GeoDjango. All affected products—Terraform MCP Server, Veeam Service Provider Console, and Django—have available updates to resolve these issues. Operators are advised to apply the latest versions to prevent potential misuse.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker News⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router BackdoorsCVE-2026-14869, CVE-2026-15307 +4
  2. The Hacker News⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and MoreCVE-2026-15307, CVE-2026-15337 +2
  3. Bishop FoxA GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider ConsoleCVE-2026-58067, CVE-2026-58071 +2
  4. The Hacker News⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and MoreCVE-2026-1207

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store