Azure MCP Server at a glance
In its March 2026 security release, Microsoft fixed CVE-2026-26118, an SSRF in Azure MCP Server Tools rated Important (CVSS 8.8). Someone who can talk to an MCP-backed agent could swap a resource ID for a malicious URL and capture the server's managed identity token. Fixed in 1.0.2 and 2.0.0-beta.17.
Azure MCP Server: status
- Affected
- Azure MCP Server Tools 1.0 on npm (@azure/mcp) and NuGet (Azure.Mcp): update to 1.0.2
- Azure MCP Server Tools 2.0.0 prereleases on npm, NuGet, and PyPI (msmcp-azure): update to 2.0.0-beta.17
- CVE identifiers
- Status as of
- Discovered by
- Daniel Santos (Microsoft)
What changed with Azure MCP Server
Microsoft's advisory explains that some Azure MCP Server tools accept user-supplied parameters such as Azure resource identifiers. An attacker who can interact with an agent backed by the server could submit a URL instead, causing the server to send an outbound request to that address and possibly include its managed identity token. The attacker would then hold whatever permissions that identity has; Microsoft says this does not grant broader tenant or administrator rights.
The update guide lists the 1.0 packages on npm (@azure/mcp) and NuGet (Azure.Mcp), fixed in 1.0.2, and the 2.0.0 prereleases on npm, NuGet, and PyPI (msmcp-azure), fixed in 2.0.0-beta.17. Microsoft marks customer action as required, rates exploitation less likely, and reported no public disclosure or exploitation at release. The finder is credited as Daniel Santos with Microsoft.
How to fix it: Azure MCP Server
1. Update
Update Azure MCP Server to 1.0.2 (1.0 line) or 2.0.0-beta.17 (2.0 prereleases) for the package manager you use.
msrc.microsoft.com (opens in a new tab)
Advisories
- Microsoft Security Update Guide CVE-2026-26118 (opens in a new tab)msrc.microsoft.com
- NVD CVE-2026-26118 (opens in a new tab)nvd.nist.gov
Where to compare Azure MCP Server
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why Azure MCP Server matters for businesses
MCP servers often run with a cloud identity so agents can manage real resources, which makes that identity a prime target. Teams using Azure MCP Server should update the package they deploy, give its managed identity only the roles it truly needs, and treat any agent that accepts outside input as a possible path to that identity.
Sources for this story
- Azure MCP Server Tools Elevation of Privilege Vulnerability (CVE-2026-26118) (opens in a new tab)Official
Microsoft Security Response Center · msrc.microsoft.com
- CVE-2026-26118 (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #azure
- #mcp
- #ssrf
- #microsoft
