CVE-2026-33980

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33980", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T22:20:06.210Z", "datePublished": "2026-03-27T21:32:57.541Z", "dateUpdated": "2026-03-27T21:56:16.579Z"}, "containers": {"cna": {"title": "Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries", "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "lang": "en", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp"}, {"name": "https://github.com/pab1it0/adx-mcp-server/commit/0abe0ee55279e111281076393e5e966335fffd30", "tags": ["x_refsource_MISC"], "url": "https://github.com/pab1it0/adx-mcp-server/commit/0abe0ee55279e111281076393e5e966335fffd30"}], "affected": [{"vendor": "pab1it0", "product": "adx-mcp-server", "versions": [{"version": "<= 1.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T21:32:57.541Z"}, "descriptions": [{"lang": "en", "value": "Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster. Commit 0abe0ee55279e111281076393e5e966335fffd30 patches the issue."}], "source": {"advisory": "GHSA-vphc-468g-8rfp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-27T21:55:57.812415Z", "id": "CVE-2026-33980", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T21:56:16.579Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33980", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-27T21:55:57.812415Z"}}}], "references": [{"url": "https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T21:56:12.790Z"}}], "cna": {"title": "Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries", "source": {"advisory": "GHSA-vphc-468g-8rfp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pab1it0", "product": "adx-mcp-server", "versions": [{"status": "affected", "version": "<= 1.1.0"}]}], "references": [{"url": "https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp", "name": "https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pab1it0/adx-mcp-server/commit/0abe0ee55279e111281076393e5e966335fffd30", "name": "https://github.com/pab1it0/adx-mcp-server/commit/0abe0ee55279e111281076393e5e966335fffd30", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster. Commit 0abe0ee55279e111281076393e5e966335fffd30 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T21:32:57.541Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33980", "state": "PUBLISHED", "dateUpdated": "2026-03-27T21:56:16.579Z", "dateReserved": "2026-03-24T22:20:06.210Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-27T21:32:57.541Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "adx-mcp-server", "vendor": "pab1it0", "versions": [{"status": "affected", "version": "<= 1.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pab1it0:azure_data_explorer_mcp_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3933040-DE34-4038-ACFC-1DD6D5BA0842", "versionEndIncluding": "0.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster. Commit 0abe0ee55279e111281076393e5e966335fffd30 patches the issue."}, {"lang": "es", "value": "El servidor MCP de Azure Data Explorer es un servidor de Protocolo de Contexto de Modelo (MCP) que permite a los asistentes de IA ejecutar consultas KQL y explorar bases de datos de Azure Data Explorer (ADX/Kusto) a trav\u00e9s de interfaces estandarizadas. Las versiones hasta la 0.1.1 inclusive contienen vulnerabilidades de inyecci\u00f3n de KQL (Kusto Query Language) en tres manejadores de herramientas MCP: \u2019get_table_schema\u2019, \u2019sample_table_data\u2019 y \u2019get_table_details\u2019. El par\u00e1metro \u2019table_name\u2019 se interpola directamente en las consultas KQL a trav\u00e9s de f-strings sin ninguna validaci\u00f3n o saneamiento, permitiendo a un atacante (o un agente de IA inyectado por prompt) ejecutar consultas KQL arbitrarias contra el cl\u00faster de Azure Data Explorer. El commit 0abe0ee55279e111281076393e5e966335fffd30 soluciona el problema."}], "id": "CVE-2026-33980", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33980", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-27T21:55:57.812415Z", "version": "2.0.3"}}]}, "published": "2026-03-27T22:16:22.607", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pab1it0/adx-mcp-server/commit/0abe0ee55279e111281076393e5e966335fffd30"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "adx-mcp-server", "source": "cna", "vendor": "pab1it0"}, "product": "adx-mcp-server", "vendor": "pab1it0"}], "analysis": {"en": {"generated_at": "2026-03-28T05:53:03.910051+00:00", "value": {"mitigation_remediation": ["Upgrade the MCP server to a version newer than 0.1.1, applying the patch referenced in commit 0abe0ee55279e111281076393e5e966335fffd30.", "Restrict network access to the MCP server so that only trusted clients can communicate with it.", "Implement input validation or parameterization in any custom MCP handlers to ensure that table names cannot be maliciously crafted.", "Monitor MCP traffic and audit KQL logs for anomalous query patterns."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary KQL query execution leading to unauthorized data access"}, "threat_synthesis": {"affected_systems": "The affected product is the adx\u2011mcp\u2011server maintained by pab1it0. Versions up to and including 0.1.1 are vulnerable; any installation using those releases should be considered at risk.", "description_and_impact": "The vulnerability lies in the MCP server\u2019s handling of the table_name parameter, which is directly interpolated into KQL queries via f\u2011strings without sanitization. This flaw allows an attacker or a maliciously prompted AI assistant to inject arbitrary KQL code, granting the ability to read, modify, or delete data in the Azure Data Explorer cluster. The weakness is a classic command injection, specifically CWE\u2011943, and can have serious confidentiality and integrity consequences.", "risk_and_exploitability": "With a CVSS score of 8.3 the vulnerability is classified as high severity. The EPSS score is not available, and the flaw has not yet been listed in the CISA KEV catalog. The likely attack vector is through legitimate MCP client traffic or an AI assistant that is given control of the client; the attacker need not have prior credentials beyond the ability to send MCP requests."}}}}, "created": "2026-03-29T20:29:34.409934+00:00", "updated": "2026-03-30T06:59:59.898045+00:00", "vendors": ["pab1it0", "pab1it0$PRODUCT$adx-mcp-server"]}