# Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)

- **Severity:** High
- **Signature ID:** `d3b6bb4a-d76f-4d9f-a5ce-89750606dbc6`
- **CVEs:** CVE-2026-32211
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI09 (Traceability and Accountability Gaps), LLM03 (Supply Chain), LLM06 (Excessive Agency)

## Summary

A flaw in Azure MCP Server (CVE-2026-32211) lets an unauthenticated attacker connect over the network and pull information out of it. There is no missing patch to apply against a version number here — the issue is a server that was never configured to require authentication in the first place.

## How the attack works

An attacker finds or is pointed at an Azure MCP endpoint that has no authentication, token, or header requirement configured. They connect directly and perform the normal MCP handshake, which the server answers by listing its available tools without ever issuing an Authorization challenge. From that unauthenticated session the attacker can read whatever information the exposed tools return, and any skill or tool description referencing this open surface confirms the exposure. No credentials, exploit chain, or privilege escalation is needed — the missing check is the whole vulnerability.

## Why it matters

Anyone who can reach the endpoint over the network can read data and tool/capability information from the MCP server without proving who they are, and the access leaves no accountable identity in logs.

## What you can do

- Require authentication (API key, OAuth token, or equivalent) on every Azure MCP Server endpoint before it is reachable from any network beyond localhost.
- Audit MCP server configuration files for endpoints missing an auth, headers, or token field, especially anything pointing at Azure MCP addresses.
- Put a gateway or reverse proxy in front of MCP servers that enforces authentication if the server itself cannot, and restrict network exposure to trusted callers only.
- Review MCP handshake logs for tool-listing responses returned without an Authorization challenge, and treat any such response as an exposed instance.

## Known benign look-alikes

- Local development MCP server bound to localhost:N where missing auth is intentional and gateways enforce access elsewhere.
- Educational documentation describing the Azure MCP Server architecture.
- Security tooling that scans MCP configurations for the missing-auth pattern.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00435
- https://nvd.nist.gov/vuln/detail/CVE-2026-32211

---
Source: https://www.netzilo.com/threats/atr-azure-mcp-server-missing-authentication-for-critical-functio