{"id":"CVE-2026-26118","aliases":["EUVD-2026-10689","GHSA-hhfx-wfvq-7g9c","PYSEC-2026-2669"],"status":"published","title":"Azure MCP Server Tools Elevation of Privilege Vulnerability","description":"Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01062,"percentile":0.65071,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-918"],"published":"2026-03-10T17:05:21Z","modified":"2026-09-10T03:50:39Z","exploits":[{"source":"pocgithub","id":"j-dahl7/mcp-attack-detection-sentinel","title":"j-dahl7/mcp-attack-detection-sentinel","date":"2026-03-17","url":"https://github.com/j-dahl7/mcp-attack-detection-sentinel"}],"fixes":[{"ecosystem":"NuGet","package":"Azure.Mcp","fixed_in":["2.0.0-beta.17","1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@azure/mcp","fixed_in":["2.0.0-beta.17","1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"msmcp-azure","fixed_in":["2.0.0b17"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Azure.Mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta.1"},{"fixed":"2.0.0-beta.17"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Azure.Mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@azure/mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta.1"},{"fixed":"2.0.0-beta.17"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"msmcp-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0b14"},{"fixed":"2.0.0b17"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@azure/mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Azure.Mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta.1"},{"fixed":"2.0.0-beta.17"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Azure.Mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}],"versions":["1.0.0","1.0.1"]},{"source":"osv","ecosystem":"npm","package":"@azure/mcp","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-beta.1"},{"fixed":"2.0.0-beta.17"}]}]},{"source":"osv","ecosystem":"PyPI","package":"msmcp-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0b14"},{"fixed":"2.0.0b17"}]}]},{"source":"osv","ecosystem":"npm","package":"@azure/mcp","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"msmcp-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0b14"},{"fixed":"2.0.0b17"}]}]}],"products":[{"vendor":"microsoft","product":"azure mcp server tools 1.0.0 (npm)"},{"vendor":"microsoft","product":"azure mcp server tools 1.0.0 (nuget)"},{"vendor":"microsoft","product":"azure mcp server tools 2.0.0 (npm)"},{"vendor":"microsoft","product":"azure mcp server tools 2.0.0 (nuget)"},{"vendor":"microsoft","product":"azure mcp server tools 2.0.0 (pypi)"},{"vendor":"microsoft","product":"azure_mcp_server"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26118","tags":["vendor-advisory","patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26118","tags":["advisory"]},{"url":"https://github.com/microsoft/mcp/commit/804ff60293206c4d8e832f772097238561bf2c34","tags":["web"]},{"url":"https://github.com/microsoft/mcp/releases/tag/Azure.Mcp.Server-1.0.2","tags":["web"]},{"url":"https://github.com/microsoft/mcp/releases/tag/Azure.Mcp.Server-2.0.0-beta.17","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hhfx-wfvq-7g9c","tags":["advisory"]},{"url":"https://github.com/microsoft/mcp","tags":["package"]},{"url":"https://pypi.org/project/msmcp-azure","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-26118","title":"Azure MCP Server Tools Elevation of Privilege Vulnerability","description":"Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.","status":"published","published":"2026-03-10T17:05:21.115Z","modified":"2026-06-19T18:18:08.772Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-10689","description":"Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.","status":"published","published":"2026-03-10T17:05:21Z","modified":"2026-06-19T18:18:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T18:20:35.26548Z"}],"ghsa":[{"id":"GHSA-hhfx-wfvq-7g9c","title":"Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network","description":"Server-Side Request Forgery (SSRF) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.","status":"published","published":"2026-03-10T18:31:21Z","modified":"2026-03-12T19:53:07Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:39:35.644357Z"}],"nvd":[{"id":"CVE-2026-26118","description":"Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.","status":"published","published":"2026-03-10T18:18:41.18Z","modified":"2026-06-17T10:25:45.377Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:08.98071Z"}],"osv":[{"id":"GHSA-hhfx-wfvq-7g9c","title":"Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network","description":"Server-Side Request Forgery (SSRF) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.","status":"published","published":"2026-03-10T18:31:21Z","modified":"2026-09-10T03:50:39.818542295Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"PYSEC-2026-2669","title":"Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network","description":"Server-Side Request Forgery (SSRF) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.","status":"published","published":"2026-07-13T14:36:41.790695Z","modified":"2026-07-13T16:32:40.073871241Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}