CVE-2026-114123

Deferred Deferred - Pending Action

D365 F&O MCP Server Unauthenticated API Exposure

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114123

EUVD

EUVD-2026-107365

Affected Vendors & Products

Vendor	Product	Version / Range
dynamics365ninja	d365fo-mcp-server	< 1.11.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects the D365 F&O MCP Server, which is used to query Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the default Azure one-click deployment set the API key to an empty string, disabling authentication. This caused the server to bind to all network interfaces (0.0.0.0) and expose read-only tools like search and metadata retrieval without requiring authentication. Attackers could access proprietary X++ source snippets, business logic, security roles, and metadata.

Detection Guidance

Check if your d365fo-mcp-server deployment binds to 0.0.0.0 without authentication. Use curl to test the MCP endpoint: curl -X POST http://<your-server>/mcp -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","method":"search","params":["test"],"id":1}'. If responses return data without requiring an API key, the server is vulnerable.

Impact Analysis

If you deployed the server using the default Azure template before version 1.11.0 without setting an API key or network restrictions, your proprietary X++ source code, business logic, security roles, and metadata could be exposed to the internet. Attackers may retrieve sensitive information without authentication, potentially leading to intellectual property theft or further exploitation of your Dynamics 365 environment.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. Exposure of proprietary code and metadata may violate confidentiality requirements, leading to legal penalties, data breach notifications, and reputational damage.

Mitigation Strategies

Upgrade to version 1.11.0 or later. Ensure API_KEY is set to a strong value (minimum 32 characters) in your deployment. If using Azure, update the one-click template to require a non-empty apiKey parameter. Alternatively, set ALLOW_UNAUTHENTICATED=true only if protected by upstream authentication like Easy Auth or Private Endpoints.

Hi! I’m here to help you understand CVE-2026-114123. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...