Veeam console, Terraform MCP, and Django patched after cross-tenant flaws

Intelligence Summary

Veeam, HashiCorp, and the Django Software Foundation have released patches for multiple security issues. The updates cover Veeam’s Service Provider Console, HashiCorp’s Terraform MCP Server, and Django. The most severe issue allows an unauthenticated actor to obtain a managed agent’s credentials in Veeam’s console. A separate cross-tenant flaw in Terraform MCP could let one user’s Terraform token be reused by later users. Users should upgrade to the fixed versions and review whether any systems were exposed before patching.

Recommended Action

Prioritize immediate review, validate exposure, and patch or mitigate affected systems.

Topics