Description
D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.
Published: 2026-10-21
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Unauthorized Access to Proprietary X++ Source and Metadata
Action: Immediate Patch
AI Analysis

Impact

The MCP Server component of Dynamics 365 Finance & Operations exposes its API without authentication when the optional API_KEY is left empty; this allows any internet user to reach the JSON‑RPC endpoint on /mcp. The vulnerability enables attackers to read source snippets, metadata, business logic, extension wiring, security roles, and labels that are indexed by the server. These are significant confidentiality assets. The weakness is a lack of authentication (CWE‑306) compounded by improper enforcement of restrictions when the server is in read‑only mode (CWE‑1188).

Affected Systems

The affected product is D365 F&O MCP Server, provided through the dynamics365ninja:d365fo-mcp-server package, and applies to all releases prior to v1.11.0. Any deployment that follows the documented Azure one‑click process without setting a non‑empty API_KEY or adding network restrictions is exposed.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity vulnerability. Because the service is reachable over the public internet without authentication, the likelihood of exploitation is high even though an explicit EPSS score is unavailable. The vulnerability is not listed in CISA's KEV catalog, but its impact on confidential proprietary code gives it significant business value. Attackers can remotely send JSON‑RPC requests, bypass authentication, and retrieve sensitive data, effectively compromising system confidentiality.

Generated by OpenCVE AI on October 21, 2026 at 20:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade D365 F&O MCP Server to version 1.11.0 or later, which removes the unauthenticated access flaw.
  • Configure a non‑empty API_KEY when deploying the service or enable upstream authentication (e.g., Azure AD, OAuth) so that requests receive proper access control.
  • Restrict inbound traffic to the App Service by applying network security groups, VNet integration, or other firewall rules, and avoid binding the HTTP listener to 0.0.0.0; instead, use a private endpoint or IP restriction.

Generated by OpenCVE AI on October 21, 2026 at 20:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.
Title D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet
Weaknesses CWE-1188
CWE-306
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-21T16:57:47.278Z

Reserved: 2026-10-20T21:53:58.472Z

Link: CVE-2026-114123

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T17:18:25.737

Modified: 2026-10-21T17:18:25.737

Link: CVE-2026-114123

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:15:06Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default

  • CWE-306

    Missing Authentication for Critical Function