Live › vulnerability › CVE-2026-114123
Go to dashboardThe D365 F&O MCP Server's documented Azure one-click deployment defaults the API key to an empty string, which disables authentication on its /mcp endpoint. An anonymous attacker on the internet can call read and search tools to pull proprietary X++ code, metadata, security roles and business logic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that deployed the D365 F&O MCP Server from the documented Azure template and left the optional apiKey blank, with the App Service publicly reachable and no upstream authentication or network restrictions. Deployments with a configured API key, effective upstream authentication, or private networking are outside this scenario.
No product ranges from the sources yet.
API_KEY in the Azure portal or with az webapp config appsettings list; empty or missing means exposed.1.11.0 is affected.1.11.0 or later.API_KEY on the App Service, or restrict network access to the endpoint.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114123")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.