CVE-2026-32211: Azure MCP Server Authentication Flaw Exposes Sensitive Data (CVSS 9.1)
CVE-2026-32211 is a critical-severity authentication bypass issue (CVSS 9.1) in Azure MCP Server, a MCP server. Affected: Azure MCP Server (Microsoft-hosted: patched; on-prem: update required).
Is Azure MCP Server running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-32211- Severity
- critical
- CVSS score
- 9.1
- Attack type
- Authentication bypass
- Component
- Azure MCP Server · MCP server
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-32211?
Microsoft's Azure MCP Server contained an authentication-bypass flaw that let unauthenticated callers query resource inventories, list connected agent identities, and retrieve fragments of cached responses including subscription IDs and resource names. Hosted by an estimated 12% of Microsoft's enterprise AI customers, exposure was broad. Microsoft patched server-side; customer-run on-prem deployments must update the MCP server binary manually.
Affected versions
| Affected | Fixed in |
|---|---|
Azure MCP Server (Microsoft-hosted: patched; on-prem: update required) | No fixed version listed |
Am I affected by CVE-2026-32211?
You are affected if you run Azure MCP Server (Microsoft-hosted: patched; on-prem: update required).
How do I fix CVE-2026-32211?
On-prem deployments: update the Azure MCP Server binary to the May 16 release. Review Azure activity logs since April for unauthenticated MCP query patterns. Apply least-privilege RBAC to MCP-registered service principals.
How do I find every machine running Azure MCP Server?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Azure MCP Server and which version, then enforce a policy on it.