Veeam Console Bug Hands Over Agent Credentials; Terraform MCP Server Leaks Tokens Between Users

Key points

• HashiCorp, Veeam and the Django Software Foundation together patched 11 vulnerabilities this week across Terraform MCP Server, Veeam Service Provider Console and Django.
• A Veeam Service Provider Console flaw rated 9.5 out of 10 lets an unauthenticated attacker retrieve the login details of a managed backup agent.
• A cross-tenant bug in HashiCorp's Terraform MCP Server allows one customer's cloud access token to be reused when a different customer connects next.
• The Veeam bug is the most immediately dangerous for managed service providers, whose consoles sit on the internet and control customer backups.
• Admins should patch now and rotate any Terraform tokens or Veeam agent credentials that may have been exposed.

Three vendors pushed critical patches this week, and the pattern will look familiar to anyone who has read a cloud postmortem lately: shared services leaking state between customers, and management planes that trust the caller too much.

The fixes cover HashiCorp's Terraform MCP Server, Veeam Service Provider Console and the Django web framework, with 11 vulnerabilities in total, first reported by The Hacker News.

What actually broke?

Two bugs stand out. One lets an attacker with no login pull a customer's backup agent credentials from Veeam. The other lets one user of a HashiCorp cloud service inherit the previous user's Terraform token.

Veeam Service Provider Console is the multi-tenant dashboard that managed service providers, the outsourced IT firms many businesses use, run to look after backups for their customers. A flaw rated 9.5 out of 10 on the industry severity scale (CVSS) allows an unauthenticated attacker to reach into the console and retrieve the credentials of a managed agent, meaning the software installed on a customer's server that actually performs the backup.

Once you hold an agent's credentials, you can talk to that agent as if you were the console. In practice that means reading backup contents, altering retention, or deleting restore points. The failure mode here is the one ransomware crews pray for: quiet access to the backup layer before they touch production.

HashiCorp's issue is different in flavour but arguably worse in principle. Terraform MCP Server is the piece that lets AI coding assistants drive Terraform, HashiCorp's tool for building cloud infrastructure from code, on a user's behalf. The bug is a cross-tenant one: the server held on to a Terraform authentication token from one session and handed it to the next user who connected. That token is what Terraform uses to change things in AWS, Azure or Google Cloud.

One thing the postmortem will say is that session state was scoped to the process, not to the caller. It is the same class of mistake that has hit shared caches, shared JWT signing keys and shared database connections in every managed platform of the last decade.

Django, the Python web framework behind a large chunk of the internet, also received fixes in the same batch. Details are thinner, but admins running Django in production should apply the update on the normal cadence.

Who is affected and what should they do?

Managed service providers running Veeam Service Provider Console on the public internet are the urgent case. Patch, then assume any agent credential that was reachable before the patch is burned and rotate it.

Teams using Terraform MCP Server with an AI assistant should patch and rotate their cloud provider tokens. If a token was cached and served to another tenant, revoking it is the only clean fix. Check your cloud audit logs (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) for Terraform-driven actions you did not initiate.

Should ordinary customers worry?

Not directly, but indirectly yes. If your IT is outsourced to a provider that runs Veeam, ask them plainly whether they have patched and rotated credentials this week. That is a fair question, not a rude one.

Operational takeaway: shared control planes need per-tenant secrets, per-request, or they will eventually leak one into another.