---
id: "CVE-2026-112745"
page: "https://infrastack.ai/live/CVE-2026-112745"
kind: "vulnerability"
aliases: ["CVE-2026-112745"]
title: "Azure DevOps Server: authorized users can read data via server-side request forgery"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["azure-devops-server", "infrastructure", "self-hosted"]
not_affected_if: ["azure-devops-services"]
published_at: "2026-11-10T19:18:34+00:00"
first_seen_at: "2026-11-10T19:24:31+00:00"
updated_at: "2026-11-10T19:58:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112745", "first_seen_at": "2026-11-10T19:24:31+00:00"}]
exploit_sources: []
---

# Azure DevOps Server: authorized users can read data via server-side request forgery

Link for people: https://infrastack.ai/live/CVE-2026-112745 (this .md is for agents)

Azure DevOps Server lets an authorized user make the server send requests to internal or other addresses the user chooses, which can disclose information over the network. The sources give no further detail on which data is exposed or which versions are affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112745

## From the sources

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_