dynamics365ninja d365fo-mcp-server up to 1.10.0 ApiKeyAuth apiKeyAuth.ts apiKey authorization

Summaryinfo

A vulnerability was found in dynamics365ninja d365fo-mcp-server up to 1.10.0. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the file src/middleware/apiKeyAuth.ts of the component ApiKeyAuth. The manipulation of the argument apiKey leads to authorization. This vulnerability is traded as CVE-2026-114123. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in dynamics365ninja d365fo-mcp-server up to 1.10.0. This issue affects an unknown code block of the file src/middleware/apiKeyAuth.ts of the component ApiKeyAuth. The manipulation of the argument apiKey with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. The summary by CVE is:

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-114123 since 10/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.11.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-107365). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• dynamics365ninja

Name

• d365fo-mcp-server

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10.0

Website

• Product: https://github.com/dynamics365ninja/d365fo-mcp-server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion