Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-26118

Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.

VectorNETWORK

PublishedMar 10, 2026, 18:18

Published Bysecure@microsoft.com

Base Score

Score8.8

Package (Ecosystem)IntroducedFixedLimit

Azure.Mcp(NuGet)2.0.0-beta.12.0.0-beta.17N/A

Azure.Mcp(NuGet)1.0.01.0.2N/A

@azure/mcp(npm)2.0.0-beta.12.0.0-beta.17N/A

msmcp-azure(PyPI)2.0.0b142.0.0b17N/A

@azure/mcp(npm)1.0.01.0.2N/A

CWE-918

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK