Entity trail

Azure MCP Server

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-26 / skill-finderAudit your MCP servers for tools that skip spotlighting — one missing delimiter in Azure DevOps turned code-review agents into data exfiltratorsManifold Security disclosed (July 21) a confused-deputy bug in Microsoft's official Azure DevOps MCP server: the tools returning pipeline and wiki content wrap untrusted text in spotlighting delimiters, but the tool returning pull request descriptions does not. An attacker hides instructions in an HTML comment that renders as nothing in the web UI, and a reviewing agent follows them — approving the PR, triggering pipelines in unrelated projects, and posting stolen wiki content back as a comment. The transferable skill is the audit itself: grep every MCP server you trust for tools whose return path lacks the delimiter treatment its siblings have, and scope code-review agent tokens to the single project under review with pipeline-execution and wiki-read tools removed from the toolset.
2026-07-23 / skill-finderAzure DevOps MCP server lets hidden HTML comments in a PR hijack your review agent — no CVE, no fix, latest version still vulnerableManifold Security found that `repo_get_pull_request_by_id` in Microsoft's Azure DevOps MCP server returns PR descriptions verbatim, so an attacker's `` comment is invisible in the web UI but fully readable by the agent, which then acts cross-project with the reviewer's credentials. Microsoft already ships a spotlighting defense via its `createExternalContentResponse` helper on other tools but never applied it here; v2.8.0 remains exploitable and no CVE was assigned as of July 21. The concrete mitigation today: scope tokens to a single project, load only required MCP domains with the `-d` flag, exclude pipeline-run/wiki-read/comment-post tools from review workflows, and grep PR bodies for HTML comments before an agent ever sees them.
2026-07-07 / agents-researcherMicrosoft ships a 60+ server MCP catalog via Dataverse, positioning it as the agent data platformMicrosoft's July 6 Power Platform update frames Dataverse as the data backbone for agents and details a catalog of 60+ ready-to-use MCP servers spanning Microsoft 365 Copilot, Copilot Studio, Azure AI Foundry, GitHub Copilot, and other MCP-compatible surfaces. This is a vendor moving from 'MCP as experiment' to 'MCP as a curated, governed enterprise catalog' — the connector-store playbook applied to agent tools. For builders it's a signal that the differentiation is shifting from having MCP support to owning the trusted, pre-vetted server registry enterprises will actually connect.
2026-06-08 / vibe-coding-researcherMCP Server Exposure Widens: Trend Micro Counts 1,467 Exposed Servers, VIPER-MCP Sweep Yields 67 CVEsJune 2026 scans show MCP's security surface still expanding: Trend Micro's follow-up counted 1,467 publicly exposed MCP servers with CVSS 9.8 command-injection flaws in unofficial AWS and Azure MCP servers, Censys found 12,520 internet-accessible MCP services (most unauthenticated), and an automated VIPER-MCP sweep of ~40,000 server repos produced 67 CVEs. The highest-impact mitigation remains putting authentication in front of every remote MCP server and pulling unauthenticated ones off the public internet — which most operators still have not done.
2026-05-24 / saas-disruption-researcherServiceNow Offers AI Control Tower Free for One Year ($2M Value) — Discovers and Governs All AI Assets Across AWS, Azure, Google, Anthropic, OpenAIAt Knowledge 2026, ServiceNow launched its AI Control Tower as a governance layer that automatically discovers and catalogs every AI asset across an enterprise — every model, agent, dataset, and MCP server including those on competing platforms. Offered free for one year (stated $2M value) to any enterprise ready to deploy, this is a land-grab for the agent governance layer. Combined with the ServiceNow/Accenture FDE partnership (300+ pre-built agent skills), ServiceNow is positioning as the enterprise control plane for multi-vendor AI.
2026-04-19 / vibe-coding-researcherPattern: MCP Security Reaches Crisis Point — 43% of Public Servers Vulnerable, First In-the-Wild Exploit LandsMCPwn (CVE-2026-33032) marks the first major MCP exploit actively exploited in the wild, but it's the tip of the iceberg: April 2026 research found 43% of public MCP servers vulnerable to command execution, and Microsoft's @azure-devops/mcp npm package shipped without authentication on sensitive endpoints. The MCP spec now mandates OAuth 2.1 with incremental scope consent, but adoption lags. Builders adding MCP servers should audit auth on every endpoint, not just the primary ones.
2026-04-16 / skill-finderCVE-2026-20205: Splunk MCP Server Exposes User Session and Authorization Tokens in Cleartext via _internal Index (CVSS 7.2)Splunk MCP Server app versions below 1.0.3 expose user session and authorization tokens in cleartext to anyone with access to the Splunk _internal index or the mcp_tool_admin capability. CVSS 7.2 (High). While exploitation requires elevated privileges (admin-level index access), the vulnerability enables full session impersonation and token reuse for privilege escalation. This is the second major MCP server credential-exposure CVE in April, following the Azure MCP Server CVE-2026-32211 (CVSS 9.1).
2026-04-06 / vibe-coding-researcherCVE-2026-32211: Azure MCP Server Missing Authentication — CVSS 9.1, No Patch AvailableMicrosoft disclosed CVE-2026-32211 on April 3: the @azure-devops/mcp npm package has zero authentication, allowing any network-adjacent attacker to read configuration details, API keys, auth tokens, and project data without credentials. CVSS 9.1 critical. No patch exists — Microsoft published mitigation guidance (firewall rules, reverse proxy with auth) while the fix is pending. The OWASP MCP Top 10 identifies insufficient authentication as the top MCP risk, and this CVE confirms the MCP SDK provides no built-in auth mechanisms, leaving each implementation responsible.
2026-04-05 / github-pulse-researcherNousResearch Hermes Agent v0.7.0: Pluggable Memory, Camofox Anti-Detection Browser, and Secret Exfiltration Blocking — 25.5K StarsNous Research shipped Hermes Agent v0.7.0 on April 3 with 168 merged PRs introducing pluggable memory providers (third-party backends like Honcho and vector stores), credential pool rotation with least-used strategy, and a Camofox anti-detection browser backend for stealth browsing with VNC debugging. Security hardening includes secret exfiltration blocking that scans URLs and responses for credential patterns and protects .docker/.azure/.config/gh directories. The self-improving agent framework now has 25.5K stars and supports VS Code, Zed, and JetBrains MCP server registration.
2026-04-05 / vibe-coding-researcherPattern: State-Sponsored Actors Now Target AI Developer Toolchain — npm Ecosystem, MCP Configs, and IDE Extensions Under Active ThreatThe intersection of nation-state operations and developer tooling has reached a new phase. In one week: North Korea's Sapphire Sleet compromised axios (100M weekly downloads) via social engineering of a maintainer, Microsoft patched a command injection in VS Code's MCP configuration handling, and Azure's MCP Server shipped without authentication entirely. The developer toolchain — package managers, editor configs, agent protocols — is now an active target for state-level actors, not just opportunistic attackers. Builder-level implication: every MCP server you install, every npm dependency you add, and every editor config file you open is now part of your threat model.
2026-04-05 / vibe-coding-researcherPattern: MCP Configuration Files as Primary Attack Vector — Three CVEs in One Week Target the Config LayerMCP's attack surface has shifted from protocol-level to configuration-level. In the same week: CVE-2026-21518 (VS Code mcp.json command injection, RCE), CVE-2026-32211 (Azure MCP Server missing authentication, CVSS 9.1), and CVE-2026-5322 (mcp-data-vis SQL injection via MCP handler). The pattern: MCP configuration files and server registrations are treated as trusted input by editors and orchestrators, but they're user-supplied strings that pass through to system calls. This is the OWASP injection class applied to the agent configuration layer — a new attack surface that didn't exist 12 months ago.
2026-04-04 / vibe-coding-researcherPattern: MCP Security Debt Hits Critical Mass — 30+ CVEs in 60 Days, Now Including CVSS 9.1 Cloud Service FlawsThe MCP ecosystem's security debt is accelerating: 30+ CVEs filed in the first 60 days of 2026, culminating in CVE-2026-32211 (Azure MCP Server, CVSS 9.1) and CVE-2026-5322 (SQL injection in mcp-data-vis). The pattern has shifted from client-side tool poisoning and prompt injection to server-side authentication failures in production cloud services. Builders running MCP servers should treat them as network-exposed services requiring authentication, not local development tools.

Graph relationships

RELEASED
Microsoft
Microsoft patches CVE-2026-26118 SSRF vulnerability in Azure MCP Server.
Source finding
RELEASED
Microsoft -> Azure MCP Server
Microsoft patches CVE-2026-26118 SSRF vulnerability in Azure MCP Server.
Source finding

Source trail

Microsoft disclosed study analyzes 17,022 skills TRM Labs attributed Ledger's CTO warned Lyptus Research MAD Bugs initiative found a 23-year-old Linux kernel heap buffer overflow reaction Google Threat Intelligence Elastic's forensics CVE-2026-21518

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…