---
id: "CVE-2026-21531"
kind: "vulnerability"
aliases: ["CVE-2026-21531", "GHSA-436v-jg82-p533"]
title: "Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE"
severity: "critical"
cvss: 9.8
epss: 0.0258
exploited: false
status: "open"
category: "package"
products: [{"name": "azure-ai-language-conversations-authoring", "fixed": ["1.0.0b4"], "affected": "< 1.0.0b4", "ecosystem": "pypi"}, {"name": "microsoft azure conversation authoring client library", "fixed": [], "affected": "= 1.0.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["ai-language", "azure", "cwe-502", "package", "pypi", "python"]
not_affected_if: ["package-not-installed"]
published_at: "2026-02-10T18:16:35+00:00"
first_seen_at: "2026-10-27T15:23:43+00:00"
updated_at: "2026-10-27T15:32:59+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-436v-jg82-p533", "first_seen_at": "2026-10-27T15:23:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21531", "first_seen_at": "2026-10-27T15:32:59+00:00"}]
---

# Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE

The Azure AI Language Conversations Authoring client library for Python deserializes untrusted data without checks. An unauthorized attacker can send crafted input over the network and execute code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:azure-ai-language-conversations-authoring affected < 1.0.0b4 fixed 1.0.0b4
- vendor:microsoft azure conversation authoring client library affected = 1.0.0 fixed ?

## How to check

- Run `pip show azure-ai-language-conversations-authoring` and confirm the installed version is below `1.0.0b4`
- Search lock files and requirements for `azure-ai-language-conversations-authoring` to find pinned versions

## Fix

- Upgrade `azure-ai-language-conversations-authoring` to `1.0.0b4` or later
- Rebuild and redeploy services that bundle this package

## Timeline

- 2026-10-27T15:23:43+00:00 ghsa https://github.com/advisories/GHSA-436v-jg82-p533
- 2026-10-27T15:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-21531

## From the sources

Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_