HashiCorp, Veeam, and Django patched critical flaws the same week, led by a top-severity bug in HashiCorp's Terraform MCP Server, which connects AI assistants to Terraform. Tracked as CVE-2026-16498 and scored 10.0, it is a cross-tenant flaw in the server's multi-user HTTP mode: its cache looked up clients by session identifier alone, without binding a cached client to the token that created it, so anyone who obtained another user's session ID could run Terraform actions with that user's credential. Only the shared HTTP deployment is affected, not local single-user mode. Veeam separately fixed an unauthenticated console flaw exposing agent credentials, and Django a code-execution bug in spatial queries.
Wiz Research disclosed CosmosEscape, a critical flaw chain in Microsoft's Azure Cosmos DB that could have given an attacker read and write access to every customer database on the service, including Microsoft's own. Starting from a crafted query against an attacker-controlled Gremlin database, the researchers escaped the query sandbox using .NET reflection, ran code on a shared gateway, and retrieved a platform-wide signing secret they call the Cosmos Master Key. That key let them fetch the access key for any Cosmos DB account on demand, reaching even private, network-isolated databases. Microsoft assigned CVE-2026-66803, fixed the issue across all regions, and found no evidence of abuse. Nothing needs patching by customers.
Researchers showed that confused deputy weaknesses persist in Google Cloud and Microsoft Azure, where a trusted service can be tricked into acting on an attacker's behalf against resources it should not reach. The pattern shows up when one service holds broad permissions and accepts instructions or identifiers from a less-trusted source without verifying who is really asking, which can enable cross-tenant access or privilege escalation. It is the same class of issue behind recent findings in enterprise agent and integration tooling, where a component with a user's permissions follows attacker-supplied input. The takeaway is architectural: identity and authorization must be checked at every trust boundary, not assumed from the calling service.
Researchers at Miggo disclosed two access-control flaws in RabbitMQ, the widely used message broker, that have been present since early 2024. In the more serious one, an obsolete management endpoint had its authorization check hard-coded to always allow, so an unauthenticated attacker can leak the broker's confidential OAuth client secret in a single request, a direct path to full broker takeover where that secret is used. The second lets any logged-in user, even one with no assigned permissions, read other tenants' queue and exchange metadata, useful reconnaissance in shared environments. Both are fixed in updated releases, and the risk is sharpest where the management port is reachable from untrusted networks.
Zafran Security disclosed four vulnerabilities, collectively named DifyTap, in Dify, a popular open-source platform for building AI agents and workflows. Two are critical, two need no authentication, and three allow cross-tenant access on Dify's multi-tenant cloud, meaning one customer could quietly read another's private AI conversations and model responses, a covert exfiltration channel. The flaws include an authorization bypass that exposes any application's trace data (CVE-2026-41947), a path traversal into the internal Plugin Daemon API (CVE-2026-41948), and a file-preview authorization bypass (CVE-2026-41949). Most were fixed in Dify 1.14.2, but the path-traversal flaw remains unpatched pending the next release.
TrustStrike Labs