{"data":{"id":"79ac3f90-2d48-4c0f-974d-c03b4a832849","title":"Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug","summary":"HashiCorp, Veeam, and Django have released patches for 11 vulnerabilities, including three critical flaws: a CVSS 10.0 cross-tenant bug in Terraform MCP Server (where one user's authentication token could be reused for another user's requests), a CVSS 9.5 unauthenticated flaw in Veeam's console that exposes managed agent credentials, and a Django file-write vulnerability in spatial lookups. None of these vulnerabilities are currently being actively exploited in the wild.","solution":"Update Terraform MCP Server to version 1.1.0 or later, Veeam Service Provider Console to 9.3.0.35057, and Django to 6.0.8 or 5.2.17.","labels":["security"],"sourceUrl":"https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html","publishedAt":"2026-08-05T14:27:30.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["HashiCorp","Terraform","Veeam","Django","GeoDjango"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-08-05T14:27:30.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":null}}