Description
Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
Published: 2026-10-13
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure via Origin Validation Error
Action: Apply Patch
AI Analysis

Impact

An origin validation error in Azure DevOps allows an unauthorized attacker to read sensitive data over a network. This flaw can lead to a confidentiality breach, exposing information that should be restricted to authorized users or processes.

Affected Systems

Microsoft Azure CLI and Microsoft Azure DevOps CLI Extension are affected. No specific version details are provided in the CVE data, so any installation that has not received the fix may be vulnerable.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack likely involves a remote network request that triggers the origin validation bypass. An attacker with network access to the CLI endpoint could exploit the flaw without needing elevated privileges. The risk is limited to disclosure of data visible to the CLI session, but it can compromise any sensitive information exposed by the tool.

Generated by OpenCVE AI on October 13, 2026 at 23:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Microsoft Azure CLI and Azure DevOps CLI Extension releases that contain the origin validation fix.
  • If an upgrade is delayed, restrict network access to the CLI’s API endpoints using firewall rules so that only trusted hosts can communicate with Azure DevOps services.
  • Review and adjust any custom origin‑validation logic or security configurations to ensure that the origin header is properly verified before granting access to data.

Generated by OpenCVE AI on October 13, 2026 at 23:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft azure Cli
Vendors & Products Microsoft azure Cli

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
Title Azure DevOps Information Disclosure Vulnerability
First Time appeared Microsoft
Microsoft azure Command-line Interface
Microsoft azure Devops Cli Extension
Weaknesses CWE-346
CPEs cpe:2.3:a:microsoft:azure_command-line_interface:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:azure_devops_cli_extension:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft azure Command-line Interface
Microsoft azure Devops Cli Extension
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Azure Cli Azure Command-line Interface Azure Devops Cli Extension
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:05:22.207Z

Reserved: 2026-08-03T22:53:31.650Z

Link: CVE-2026-69877

cve-icon Vulnrichment

Updated: 2026-10-13T21:07:16.992Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:19:00.750

Modified: 2026-10-13T22:17:46.107

Link: CVE-2026-69877

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T00:15:13Z

Weaknesses