Veeam, Terraform MCP, and Django Patch Critical Vulnerabilities, Including CVSS 10.0 Flaw

Multiple Critical Vulnerabilities Addressed

HashiCorp, Veeam, and the Django Software Foundation have released security updates to address a total of 11 vulnerabilities across their respective products. These patches target critical flaws in Terraform MCP Server, Veeam Service Provider Console, and Django, with the most severe vulnerability receiving a CVSS score of 10.0.

Key Vulnerabilities Detailed

Among the patched issues, a cross-tenant flaw in HashiCorp's Terraform MCP server (CVSS 10.0) allows the reuse of one user's Terraform token for subsequent user requests. Veeam Service Provider Console received fixes for four vulnerabilities, including an unauthenticated flaw (CVE-2026-58073, CVSS 9.5) that enables an attacker to impersonate a managed agent and obtain credentials, and an arbitrary file write leading to remote code execution (CVE-2026-58072, CVSS 9.0). Django addressed a flaw in GeoDjango's spatial lookups that could write files to disk and, in some configurations, execute code, requiring a staff user with specific permissions.

Immediate Action Required for Operators

Operators are advised to update their systems immediately to mitigate these risks. Specific versions to update to include Terraform MCP Server 1.1.0 or later, Veeam Service Provider Console 9.3.0.35057, and Django 6.0.8 or 5.2.17. While none of the advisories indicate active exploitation or public proof-of-concepts, the severity of these vulnerabilities necessitates prompt patching.