Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

🗓️ 10 Mar 2026 18:31:21Reported by GitHub Advisory DatabaseType

Azure MCP Server SSRF allows an authorized attacker to elevate privileges over a network.

Reporter	Title	Published	Views	Family All 19
ATTACKERKB	CVE-2026-26118	10 Mar 202617:05	–	attackerkb
Circl	CVE-2026-26118	10 Mar 202616:57	–	circl
CNNVD	Microsoft Azure MCP Server Tools 代码问题漏洞	10 Mar 202600:00	–	cnnvd
CVE	CVE-2026-26118	10 Mar 202617:05	–	cve
Cvelist	CVE-2026-26118 Azure MCP Server Tools Elevation of Privilege Vulnerability	10 Mar 202617:05	–	cvelist
EUVD	EUVD-2026-10689	10 Mar 202618:31	–	euvd
GitLab Advisory Database	Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network	10 Mar 202600:00	–	gitlab
Kaspersky	KLA90924 Multiple vulnerabilities in Microsoft Azure	10 Mar 202600:00	–	kaspersky
Microsoft CVE	Azure MCP Server Tools Elevation of Privilege Vulnerability	10 Mar 202614:00	–	mscve
NCSC	Vulnerabilities fixed in Microsoft Azure	10 Mar 202620:15	–	ncsc

Vulners

Node

azure mcpRange1.0.0–1.0.2npm

msmcp-azureRange2.0.0b14–2.0.0b17pip

azure mcpRange2.0.0-beta.1–2.0.0-beta.17npm

azure.mcpRange1.0.0–1.0.2nuget

azure.mcpRange2.0.0-beta.1–2.0.0-beta.17nuget

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-26118
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26118
github	www.github.com/microsoft/mcp/commit/804ff60293206c4d8e832f772097238561bf2c34
github	www.github.com/microsoft/mcp/releases/tag/Azure.Mcp.Server-1.0.2
github	www.github.com/microsoft/mcp/releases/tag/Azure.Mcp.Server-2.0.0-beta.17
github	www.github.com/advisories/GHSA-hhfx-wfvq-7g9c

12 Mar 2026 19:53Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.8

EPSS0.00049

SSVC