CVE-2026-58201 Lokka: Azure Resource Manager URL path validation issue

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-58201 Lokka: Azure Resource Manager URL path validation issue

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

EUVD-2026-78934

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

PT-2026-92124

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-58201: Server-Side Request Forgery (SSRF)

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

GHSA-G2GW-Q38M-VJFC Lokka: Azure Resource Manager URL path validation issue

Lokka versions prior to 2.1.2 constructed Azure Resource Manager request URLs using direct string concatenation with user-controlled path input. Specially crafted path values could alter URL authority parsing and cause Azure Resource Manager bearer tokens to be sent to an unintended host. Version...

Server-side Request Forgery (SSRF)

Overview @merill/lokka is a Lokka is a Model Context Protocol MCP server for Microsoft Graph. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of user-supplied input in the process constructing Azure Resource Manager request URLs. An...

The vulnerability of the Azure Resource Manager service and the software platform of Microsoft Azure allows attackers to escalate their privileges.

The vulnerability of the Azure Resource Manager service, a software platform of Microsoft Azure, relates to the bypassing of authentication using an alternative name. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...

The vulnerability of the Azure Resource Manager deployment and management service, as well as the Azure Local software platform, is related to authentication procedures that have flaws. This allows attackers to escalate their privileges.

The vulnerability of the Azure Resource Manager deployment and management service, as well as the Azure Local software platform, is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain increased privileges...

CVE-2026-47280

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-47280

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-31514

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-47280 Azure Resource Manager Elevation of Privilege Vulnerability

...

CVE-2026-47280 Azure Resource Manager Elevation of Privilege Vulnerability

...

CVE-2026-47280

CVE-2026-47280 describes an elevation of privilege in Azure Resource Manager due to improper authentication. The vulnerability is network-exploitable with no authentication or user interaction required, granting attacker HIGH integrity, confidentiality, and availability impact. CVSS 3.1 base scor...

CVE-2026-47280

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-47280: Improper Authentication

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

Microsoft Azure Resource Manager 授权问题漏洞

Microsoft Azure Resource Manager is a deployment and management service provided by the American company Microsoft. There is an authorization issue vulnerability in Microsoft Azure Resource Manager, which stems from improper authentication practices. This vulnerability could allow unauthorized...

Azure Resource Manager Elevation of Privilege Vulnerability

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

PT-2026-42851

Name of the Vulnerable Software and Affected Versions Azure Resource Manager affected versions not specified Description Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no informati...