Veeam Console Bug Hands Over Agent Credentials; Terraform MCP Server Leaks Tokens Between Users
Eleven fixes across HashiCorp, Veeam and Django include a 9.5-rated Veeam flaw and a cross-tenant Terraform MCP Server bug that hands one customer's cloud token to the next caller.
Key points
- HashiCorp, Veeam and the Django Software Foundation patched 11 vulnerabilities this week across Terraform MCP Server, Veeam Service Provider Console and Django.
- A Veeam Service Provider Console flaw rated 9.5 out of 10 lets an unauthenticated attacker retrieve the login details of a managed backup agent.
- A cross-tenant bug in HashiCorp's Terraform MCP Server allows one customer's cloud access token to be reused when a different customer connects next.
- The Veeam bug is the most immediately dangerous for managed service providers, whose consoles sit on the internet and control customer backups.
- Patch now and rotate any Terraform tokens or Veeam agent credentials that may have been exposed.
Three vendors pushed critical patches this week, and the pattern's one this beat has seen too many times: shared services leaking state between customers, and management planes that trust the caller far too much.
The fixes cover HashiCorp's Terraform MCP Server, Veeam Service Provider Console and the Django web framework, 11 vulnerabilities in total, first reported by The Hacker News.
What actually broke?
Two bugs stand out. One lets an attacker with no login pull a customer's backup agent credentials from Veeam. The other lets one user of a HashiCorp cloud service inherit the previous user's Terraform token.
Veeam Service Provider Console is the multi-tenant dashboard that managed service providers, the outsourced IT firms many businesses use, run to look after customer backups. A flaw rated 9.5 out of 10 on the CVSS severity scale allows an unauthenticated attacker to retrieve the credentials of a managed agent: the software installed on a customer's server that actually performs the backup. If you need a primer on how CVSS scores work, our explainer from 23 July covers it.
Once you hold an agent's credentials, you can talk to that agent as if you were the console. That means reading backup contents, deleting restore points, or altering retention policies. The failure mode ransomware crews pray for: quiet access to the backup layer before they touch production.
HashiCorp's issue is different in flavour but arguably worse in principle. Terraform MCP Server is the piece that lets AI coding assistants drive Terraform, HashiCorp's tool for building cloud infrastructure from code, on a user's behalf. The bug is a cross-tenant one: the server held on to a Terraform authentication token from one session and handed it to the next user who connected. That token is what Terraform uses to change things in AWS or Azure.
The postmortem will say session state was scoped to the process, not to the caller. It's the same class of mistake that has hit shared caches and shared database connections in every managed platform of the last decade. We saw the OAuth-secret variant of this exact problem in RabbitMQ back in July.
Django, the Python web framework, also received fixes in this batch. Details are thinner, but admins running Django in production should apply the update on the normal cadence.
Who is affected and what should they do?
Managed service providers running Veeam Service Provider Console on the public internet are the urgent case. Patch, then treat any agent credential reachable before the patch as burned and rotate it.
Teams using Terraform MCP Server with an AI assistant should patch and rotate their cloud provider tokens. If a token was cached and served to another tenant, revoking it is the only clean fix. Check your cloud audit logs, AWS CloudTrail or Azure Activity Log, for Terraform-driven actions you didn't initiate.
| Product | Severity | What the bug does | Fix |
|---|---|---|---|
| Veeam Service Provider Console | 9.5 (Critical) | Unauthenticated retrieval of managed agent credentials | Vendor patch, rotate agent creds |
| HashiCorp Terraform MCP Server | Critical | Cross-tenant reuse of Terraform tokens | Vendor patch, rotate cloud tokens |
| Django | See advisory | Multiple, part of 11-CVE batch | Upgrade to fixed release |
Should ordinary customers worry?
Not directly, but indirectly yes. If your IT is outsourced to a provider that runs Veeam, ask them plainly whether they've patched and rotated credentials this week. That's a fair question, not a rude one.
Shared control planes need per-tenant secrets scoped to each request, or they will eventually leak one tenant's access into another's. That's not a prediction. It's a pattern.
