Yüksek CVSS 8.1 PoC var
CVE-2026-33980: Azure Data Explorer Mcp Server: güvenlik açığı
Açıklama (NVD)
Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster. Commit 0abe0ee55279e111281076393e5e966335fffd30 patches the issue.
Özet bilgiler
- Ürün
- Pab1it0 Azure Data Explorer Mcp Server
- CVSS v3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - EPSS
- %0,40 (yüzdelik 35)
- CWE
- CWE-943
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| pab1it0-azure-data-explorer-mcp-server | — | 0.1.0 | — |