Skip to content
SSRF Vulnerability in Azure MCP Server Exposes Managed Identity Tokens

SSRF Vulnerability in Azure MCP Server Exposes Managed Identity Tokens

First seen 5 Nov 2026, 16:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 5, 2026 at 16:20 UTC
  • •CVE-2026-26118 is a high-severity SSRF vulnerability in Azure MCP Server Tools.
  • •Attackers can exploit this flaw to leak managed identity tokens through malicious URLs.
  • •Microsoft has released patches, and no exploitation was reported prior to the disclosure.

Microsoft disclosed CVE-2026-26118 on March 10, 2026, detailing a server-side request forgery (SSRF) vulnerability in Azure MCP Server Tools. This flaw allows attackers to submit malicious URLs, potentially leaking managed identity tokens. The vulnerability affects users interacting with MCP-backed agents, with a CVSS score of 8.8, indicating a high severity. No exploitation or public disclosure occurred before the patch, which was included in versions 1.0.2 and 2.0.0-beta.17. The Orca AI Incident Archive recorded this incident, noting no real harm was reported. The advisory emphasizes the importance of applying the patch to mitigate risks associated with this vulnerability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-11-16
Public exploit for CVE-2026-25253 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-03-10
CVE-2026-26118 published
Microsoft disclosed a server-side request forgery vulnerability in Azure MCP Server Tools, affecting managed identity tokens.
Orcarouter.Ai
2026-03-15
First public PoC released
A proof-of-concept demonstrating the SSRF vulnerability was made public, highlighting the potential for token leakage.
Orcarouter.Ai

More articles in this cluster (2)

Following this threat?

Track Azure and CVE-2026-25253 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

What systems are affected by CVE-2026-26118?
The vulnerability affects Azure MCP Server Tools used by AI agents and MCP clients.
Has this vulnerability been exploited in the wild?
No, there have been no reports of exploitation prior to the patch release.
What should organizations do to protect themselves?
Organizations should apply the patches provided in versions 1.0.2 and 2.0.0-beta.17 as soon as possible.