CVE-2026-109467 · Vendor
NO FIX YET
Microsoft (MSRC, 10 Nov 2026) rates this Azure DevOps improper-authentication flaw CVSS 9.9, Important, not exploited and not publicly disclosed. Per MSRC's FAQ, an attacker with Project Reader access to an affected organization can send a crafted network request that triggers unauthorized pipeline execution and runs code on pipeline agents. The MSRC record lists no affected versions and no fixed build; the title says Azure DevOps Server, the description just says Azure DevOps.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Azure DevOps Server, or Azure DevOps organizations, where people hold Project Reader access and pipelines run on agents. MSRC's record does not list affected versions or whether Services (cloud) is included, so scope beyond Server is unconfirmed. Teams without Azure DevOps can skip it.
Who cares azure-devops, pipelines, self-hosted
No fix yet, per the sources.
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.