{"id":"CVE-2026-114123","kind":"vulnerability","aliases":["CVE-2026-114123"],"related":[],"title":"D365 F&O MCP Server: blank API key leaves X++ source readable anonymously","description":"D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.","summary":"The D365 F&O MCP Server's documented Azure one-click deployment defaults the API key to an empty string, which disables authentication on its /mcp endpoint. An anonymous attacker on the internet can call read and search tools to pull proprietary X++ code, metadata, security roles and business logic.","severity":"high","cvss":7.5,"epss":0.00423,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["app-service","azure","d365-fo","dynamics-365","mcp","package"],"not_affected_if":["api-key-configured","network-restricted","upstream-auth"],"how_to_check":"- Check the App Service setting `API_KEY` in the Azure portal or with `az webapp config appsettings list`; empty or missing means exposed.\n- Check the installed server version; anything below `1.11.0` is affected.\n- Confirm whether the App Service is reachable from the internet, not only from a private network.","fix":"- Upgrade the D365 F&O MCP Server to `1.11.0` or later.\n- Set a strong `API_KEY` on the App Service, or restrict network access to the endpoint.\n- Rotate any indexed metadata or labels if the endpoint was reachable while blank.","status":"open","published_at":"2026-10-21T17:18:25+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:37+00:00","updated_at":"2026-10-25T03:16:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:16:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the D365 F&O MCP Server to `1.11.0` or later.\n- Set a strong `API_KEY` on the App Service, or restrict network access to the endpoint.\n- Rotate any indexed metadata or labels if the endpoint was reachable while blank.","reach":"internet","title":"D365 F&O MCP Server: blank API key leaves X++ source readable anonymously","impact":"medium","summary":"The D365 F&O MCP Server's documented Azure one-click deployment defaults the API key to an empty string, which disables authentication on its /mcp endpoint. An anonymous attacker on the internet can call read and search tools to pull proprietary X++ code, metadata, security roles and business logic.","category":"package","nicknames":[],"who_cares":["d365-fo","dynamics-365","azure","mcp","app-service"],"confidence":0.8,"needs_auth":"no","worst_case":"Anyone on the internet reads proprietary X++ code and security metadata","analyst_note":"","how_to_check":"- Check the App Service setting `API_KEY` in the Azure portal or with `az webapp config appsettings list`; empty or missing means exposed.\n- Check the installed server version; anything below `1.11.0` is affected.\n- Confirm whether the App Service is reachable from the internet, not only from a private network.","needs_analyst":false,"not_affected_if":["api-key-configured","network-restricted","upstream-auth"],"who_is_affected":"Teams that deployed the D365 F&O MCP Server from the documented Azure template and left the optional apiKey blank, with the App Service publicly reachable and no upstream authentication or network restrictions. Deployments with a configured API key, effective upstream authentication, or private networking are outside this scenario.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":3757,"output_tokens":641,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114123':16A,19A '-2026':15A,18A '-365':28B '/mcp':57B,191C '0.0.0.0':157C '1.11.0':106C,288C '365':96C 'access':206C,275C 'add':171C 'allow':183C 'anonym':13A,60B,205C 'api':7A,46B,135C,139C,265C 'apikey':122C 'app':21B,133C,181C 'app-servic':20B 'attack':61B,274C 'authent':54B,149C,177C,269C 'azur':23B,39B,110C 'batch':215C 'bind':152C 'blank':6A,167C 'busi':80B,240C 'call':66B 'click':42B,113C 'code':75B,100C 'configur':264C 'context':90C 'cve':14A,17A 'd365':1A,25B,32B,82C 'd365-fo':24B 'default':44B,120C,159C 'deploy':43B,114C,162C,193C,260C 'disabl':53B 'document':38B,109C 'dynam':27B,95C 'effect':267C 'empti':50B,126C,143C 'endpoint':58B 'event':226C,245C 'event-handl':244C 'expos':228C,236C 'exposur':280C 'extens':218C,242C 'f':2A,33B,83C 'financ':97C 'find':222C,225C 'fix':285C 'fo':26B 'get':212C,216C 'handler':227C,246C 'http':154C 'includ':210C,239C 'index':229C,257C 'info':214C,217C,219C,221C 'inform':237C 'infrastructure/azuredeploy.json':116C 'infrastructure/main.bicep':118C 'internet':64B 'issu':283C 'json':186C 'json-rpc':185C 'key':8A,47B,136C,140C,166C,266C 'label':255C 'leav':9A,163C 'listen':155C 'logic':81B,241C 'mcp':4A,29B,35B,85C,195C 'metadata':76B,102C,235C 'mode':197C 'model':89C 'network':173C,271C 'o':3A,34B,84C 'object':213C 'offici':108C 'one':41B,112C 'one-click':40B,111C 'oper':98C 'option':165C 'origin':256C 'outsid':277C 'packag':30B 'packageslocaldirectori':259C 'paramet':123C 'pass':129C,145C 'prevent':204C,273C 'prior':103C 'privileg':252C 'proprietari':73B,230C 'protect':261C 'protocol':91C 'public':180C 'pull':72B 'queri':94C 'read':67B,199C 'read-on':198C 'read/search':208C 'readabl':12A 'refer':223C 'request':146C,189C 'restrict':174C,272C 'result':179C 'role':78B,250C 'rpc':187C 'scenario':281C 'search':69B,211C 'secur':77B,220C,249C 'security-rol':248C 'separ':172C 'server':5A,36B,86C,92C,196C 'servic':22B,134C,182C 'set':137C,201C 'snippet':233C 'sourc':11A,232C 'src/index.ts':151C 'src/middleware/apikeyauth.ts':144C 'string':51B,127C 'structur':253C 'tool':70B,209C 'tools/call':188C 'unauthent':184C,279C 'unset':141C 'upstream':176C,268C 'use':115C 'version':105C,287C 'wire':247C 'without':148C 'x':10A,74B,99C,231C","nicknames":[],"mitigations":[],"who_affected":"Teams that deployed the D365 F&O MCP Server from the documented Azure template and left the optional apiKey blank, with the App Service publicly reachable and no upstream authentication or network restrictions. Deployments with a configured API key, effective upstream authentication, or private networking are outside this scenario.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114123","severity":null,"published_at":"2026-10-21T17:18:25+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114123","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114123","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}