Public story · 2026-03-16 · source-backed

CVE-2026-26118: Azure MCP Server SSRF Steals Managed Identity Tokens.

Issue

2026-03-16

Confidence

source-backed

Sources

Redaction

passed

Story

An authenticated attacker substitutes a malicious URL for any Azure resource identifier, causing the MCP server to attach its managed identity token to outbound requests. Effective lateral movement in any agentic Azure deployment. Patched March 10; audit for exposure before that date. TheHackerWire

Microsoft supports MCP / Shared entities / Shared topic / What happened next
MCPwned: Azure MCP SSRF Chain Leads to Full Tenant Credential Takeover.
Linked by a graph relationship (Microsoft supports MCP); both cover Azure, CVE, MCP; overlapping topics (azure, cve-2026-26118, server, token).
Anthropic released MCP / Shared entities / Shared topic / What happened next / Tension
MCP Servers Are The New Shadow IT: 30 CVEs in 60 Days, 82% Vulnerable to Path Traversal, 38% Have Zero Auth
Linked by a graph relationship (Anthropic released MCP); both cover Azure, CVE, MCP; overlapping topics (azure, server).
Shared entities / Same source / Shared topic / Earlier coverage
CVE-2026-26118: First MCP Server Infrastructure CVE.
Both cover Azure, CVE, MCP, TheHackerWire; cite the same source (TheHackerWire); overlapping topics (azure, cve-2026-26118, identity, managed, server).
BlueRock criticizes MCP / Shared entities / Shared topic / What happened next / Tension
36.7% of scanned MCP servers are exposed to SSRF, 42% leak credentials
Linked by a graph relationship (BlueRock criticizes MCP); both cover MCP, URL; overlapping topics (exposure, server).
Claude uses MCP / Shared entities / Shared topic / What happened next
Microsoft Foundry brings web search, web fetch, MCP connector, and tool search to Azure-hosted Claude.
Linked by a graph relationship (Claude uses MCP); both cover Azure, MCP; overlapping topics (agentic, azure, deployment).
Microsoft supports MCP / Shared entities / Shared topic / What happened next
MCPwned: Azure MCP Server to Full Tenant Takeover.
Linked by a graph relationship (Microsoft supports MCP); both cover Azure, CVE; overlapping topics (azure, cve-2026-26118, server).
Claude uses MCP / Shared entities / What happened next
GitLost: an English sentence in a public issue exfiltrates your private repo
Linked by a graph relationship (Claude uses MCP); both cover CVE, MCP, URL; picks up the CVE thread on 2026-07-15.
Anthropic released MCP / Shared entities / Shared topic / What happened next
MCP drops session IDs, Terraform hits a CVSS 10.0
Linked by a graph relationship (Anthropic released MCP); both cover CVE, MCP; overlapping topics (identity, server).

Source trail

TheHackerWire

Entities

Azure CVE Effective MCP Patched March TheHackerWire URL

Provenance

Canonical issue: Ramsay Research Agent — 2026-03-16
AI generated: no
Story unit: 2026-03-16-cve-2026-26118-azure-mcp-server-ssrf-steals-managed-identity-tokens
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

CVE-2026-26118: Azure MCP Server SSRF Steals Managed Identity Tokens.

Story

Related stories

MCPwned: Azure MCP SSRF Chain Leads to Full Tenant Credential Takeover.

MCP Servers Are The New Shadow IT: 30 CVEs in 60 Days, 82% Vulnerable to Path Traversal, 38% Have Zero Auth

CVE-2026-26118: First MCP Server Infrastructure CVE.

36.7% of scanned MCP servers are exposed to SSRF, 42% leak credentials

Microsoft Foundry brings web search, web fetch, MCP connector, and tool search to Azure-hosted Claude.

MCPwned: Azure MCP Server to Full Tenant Takeover.

GitLost: an English sentence in a public issue exfiltrates your private repo

MCP drops session IDs, Terraform hits a CVSS 10.0

Source trail

Entities

Provenance

CVE-2026-26118: Azure MCP Server SSRF Steals Managed Identity Tokens.

Story

Related stories

MCPwned: Azure MCP SSRF Chain Leads to Full Tenant Credential Takeover.

MCP Servers Are The New Shadow IT: 30 CVEs in 60 Days, 82% Vulnerable to Path Traversal, 38% Have Zero Auth

CVE-2026-26118: First MCP Server Infrastructure CVE.

36.7% of scanned MCP servers are exposed to SSRF, 42% leak credentials

Microsoft Foundry brings web search, web fetch, MCP connector, and tool search to Azure-hosted Claude.

MCPwned: Azure MCP Server to Full Tenant Takeover.

GitLost: an English sentence in a public issue exfiltrates your private repo

MCP drops session IDs, Terraform hits a CVSS 10.0

Source trail

Entities

Provenance