Read the docs
TI-2026-26321 Aliases CVE-2026-33980GHSA-vphc-468g-8rfp

Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

Priority HIGH 71CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster. Commit 0abe0ee55279e111281076393e5e966335fffd30 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00403 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pab1it0adx-mcp-serverup to 1.1.0—No fix listedCNA
—adx-mcp-server (PyPI)up to 1.1.0—No fix listedGHSA-vphc-468g-8rfp
  • adx-mcp-server Vendorpab1it0 Affected up to 1.1.0 Fixed in — No fix listed CNA
  • adx-mcp-server (PyPI) Vendor— Affected up to 1.1.0 Fixed in — No fix listed GHSA-vphc-468g-8rfp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pab1it0:azure_data_explorer_mcp_server:*:*:*:*:*:*:*:*up to 0.1.0Vulnerablepab1it0
  • cpe:2.3:a:pab1it0:azure_data_explorer_mcp_server:*:*:*:*:*:*:*:* Versions up to 0.1.0 Vulnerable ·pab1it0

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33980
  2. 2026-10-03 Alias added: GHSA-vphc-468g-8rfp

References

Exploit 1

Patch 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences