Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114123— D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet

Quick assessment

Affected
dynamics365ninja d365fo-mcp-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

D365 F&O MCP Server 是一个用于查询 Dynamics 365 Finance & Operations（F&O）中 X++ 代码和元数据的 Model Context Protocol（MCP）服务器。在 1.11.0 版本之前，官方文档中提供的 Azure 一键式部署方案通过 和 文件，将 参数默认设置为空字符串，并将其传递给 App Service 的 设置。当 未设置或为空时， 模块会允许请求无需身份验证即可通过；同时， 默认将 HTTP 监听器绑定到 （即所有网络接口）。如果部署者留空该

CVSS 7.5 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
dynamics365ninja d365fo-mcp-server < 1.11.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114123

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet
Source: CVE Program / CVE List V5
Vulnerability Description
D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
dynamics365ninja d365fo-mcp-server < 1.11.0 -

II. Public POCs for CVE-2026-114123

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114123

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114123 (1)

Vendor Advisories for CVE-2026-114123 (1)

IV. Related Vulnerabilities

Same weakness: CWE-306

V. Comments for CVE-2026-114123

No comments yet

Leave a comment