GHSA-G2GW-Q38M-VJFC Lokka: Azure Resource Manager URL path validation issue

Lokka versions prior to 2.1.2 constructed Azure Resource Manager request URLs using direct string concatenation with user-controlled path input. Specially crafted path values could alter URL authority parsing and cause Azure Resource Manager bearer tokens to be sent to an unintended host. Version...

Server-side Request Forgery (SSRF)

Overview @merill/lokka is a Lokka is a Model Context Protocol MCP server for Microsoft Graph. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of user-supplied input in the process constructing Azure Resource Manager request URLs. An...

CVE-2026-41704

AgentClienthandlemethod lines 264-303 processes every NATS reply. It calls injectcompilelog line 273 on every response, which reads response'value''result''compilelogid' line 332-338 and passes it to downloadanddeleteblob. Separately, any response containing 'exception' goes through formatexcepti...

The vulnerability of the Azure Resource Manager service and the software platform of Microsoft Azure allows attackers to escalate their privileges.

The vulnerability of the Azure Resource Manager service, a software platform of Microsoft Azure, relates to the bypassing of authentication using an alternative name. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...

CVE-2026-41704

AgentClienthandlemethod lines 264-303 processes every NATS reply. It calls injectcompilelog line 273 on every response, which reads response'value''result''compilelogid' line 332-338 and passes it to downloadanddeleteblob. Separately, any response containing 'exception' goes through formatexcepti...

EUVD-2026-32108

AgentClienthandlemethod lines 264-303 processes every NATS reply. It calls injectcompilelog line 273 on every response, which reads response'value''result''compilelogid' line 332-338 and passes it to downloadanddeleteblob. Separately, any response containing 'exception' goes through formatexcepti...

CVE-2026-41704

CVE-2026-41704 affects BOSH Director prior to v282.1.12. The issue arises from AgentClient#handle_method handling NATS responses: it may invoke inject_compile_log and format_exception, and the blobstore resource flow calls ResourceManager#get_resource(blob_id) followed by ResourceManager#delete_r...

CVE-2026-41009

CVE-2026-41009 affects BOSH Director: all versions prior to v282.1.12. The vulnerability arises when the director uses a local blobstore; Blobstore::LocalClient#object_file_path joins the blobstore path with the provided oid without normalisation, enabling path traversal (e.g., oid = "../../jobs/...

The vulnerability of the Azure Resource Manager deployment and management service, as well as the Azure Local software platform, is related to authentication procedures that have flaws. This allows attackers to escalate their privileges.

The vulnerability of the Azure Resource Manager deployment and management service, as well as the Azure Local software platform, is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain increased privileges...

CVE-2026-47280

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-47280

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-31514

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-47280 Azure Resource Manager Elevation of Privilege Vulnerability

...

CVE-2026-47280 Azure Resource Manager Elevation of Privilege Vulnerability

...

CVE-2026-47280

CVE-2026-47280 describes an elevation of privilege in Azure Resource Manager due to improper authentication. The vulnerability is network-exploitable with no authentication or user interaction required, granting attacker HIGH integrity, confidentiality, and availability impact. CVSS 3.1 base scor...

CVE-2026-47280

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-47280: Improper Authentication

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

Microsoft Azure Resource Manager 授权问题漏洞

Microsoft Azure Resource Manager is a deployment and management service provided by the American company Microsoft. There is an authorization issue vulnerability in Microsoft Azure Resource Manager, which stems from improper authentication practices. This vulnerability could allow unauthorized...

Azure Resource Manager Elevation of Privilege Vulnerability

Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...

PT-2026-42851

Name of the Vulnerable Software and Affected Versions Azure Resource Manager affected versions not specified Description Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no informati...