{"id":"CVE-2026-112745","kind":"vulnerability","aliases":["CVE-2026-112745"],"related":[],"title":"Azure DevOps Server: authorized users can read data via server-side request forgery","description":"Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.","summary":"Azure DevOps Server lets an authorized user make the server send requests to internal or other addresses the user chooses, which can disclose information over the network. The sources give no further detail on which data is exposed or which versions are affected.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure-devops-server","infrastructure","self-hosted"],"not_affected_if":["azure-devops-services"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:34+00:00","first_seen_at":"2026-11-10T19:24:31+00:00","triaged_at":"2026-11-10T19:58:00+00:00","updated_at":"2026-11-10T19:58:00+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:58:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Azure DevOps Server: authorized users can read data via server-side request forgery","impact":"medium","summary":"Azure DevOps Server lets an authorized user make the server send requests to internal or other addresses the user chooses, which can disclose information over the network. The sources give no further detail on which data is exposed or which versions are affected.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["azure-devops-server","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized user reads information from internal network resources","analyst_note":"Check the Microsoft security response entry for affected versions, fixed builds and any configuration that enables the vulnerable feature.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["azure-devops-services"],"who_is_affected":"Teams that run Azure DevOps Server on their own infrastructure are the ones exposed, since the flaw is in the on-premises server rather than the hosted service. Only users with an account on the server can trigger it. The sources do not list affected versions or configuration details.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":4498,"output_tokens":446,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112745':17A,20A '-2026':16A,19A 'address':45B 'affect':71B 'allow':82C 'attack':85C 'author':4A,34B,84C 'azur':1A,22B,29B,79C 'azure-devops-serv':21B 'choos':48B 'cve':15A,18A 'data':8A,64B 'detail':61B 'devop':2A,23B,30B,80C 'disclos':51B,87C 'expos':66B 'forgeri':14A,76C 'give':58B 'host':28B 'inform':52B,88C 'infrastructur':25B 'intern':42B 'let':32B 'make':36B 'network':55B,91C 'read':7A 'request':13A,40B,75C 'self':27B 'self-host':26B 'send':39B 'server':3A,11A,24B,31B,38B,73C,81C 'server-sid':10A,72C 'side':12A,74C 'sourc':57B 'ssrf':77C 'user':5A,35B,47B 'version':69B 'via':9A","nicknames":[],"mitigations":[],"who_affected":"Teams that run Azure DevOps Server on their own infrastructure are the ones exposed, since the flaw is in the on-premises server rather than the hosted service. Only users with an account on the server can trigger it. The sources do not list affected versions or configuration details.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azuredevopsserver","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-112745':17A,20A '-2026':16A,19A 'author':4A 'azur':1A 'cve':15A,18A 'data':8A 'devop':2A 'forgeri':14A 'read':7A 'request':13A 'server':3A,11A 'server-sid':10A 'side':12A 'user':5A 'via':9A","search_b":"'address':45B 'affect':71B 'author':34B 'azur':22B,29B 'azure-devops-serv':21B 'choos':48B 'data':64B 'detail':61B 'devop':23B,30B 'disclos':51B 'expos':66B 'give':58B 'host':28B 'inform':52B 'infrastructur':25B 'intern':42B 'let':32B 'make':36B 'network':55B 'request':40B 'self':27B 'self-host':26B 'send':39B 'server':24B,31B,38B 'sourc':57B 'user':35B,47B 'version':69B","search_c":"'allow':82C 'attack':85C 'author':84C 'azur':79C 'devop':80C 'disclos':87C 'forgeri':76C 'inform':88C 'network':91C 'request':75C 'server':73C,81C 'server-sid':72C 'side':74C 'ssrf':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112745","severity":null,"published_at":"2026-11-10T19:18:34+00:00","modified_at":"2026-11-10T19:18:35+00:00","first_seen_at":"2026-11-10T19:24:31+00:00","fetched_at":"2026-11-10T19:24:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}