CVE-2026-114123highBroken access control2026-10-21

CVE-2026-114123: D365 F&O MCP Server's Azure one-click deploy shipped with no API key, exposing X++ source to anyone, upgrade to 1.11.0

D365 F&O MCP Server (npm d365fo-mcp) lets AI assistants search Dynamics 365 Finance & Operations X++ code and metadata. Up to 1.10.1 its documented Azure one-click deployment left the API key empty, which turns authentication off, and the server listened on all interfaces, so a public App Service answered anonymous MCP tool calls.

01.

What it is

The Azure templates (infrastructure/azuredeploy.json and main.bicep) defaulted the apiKey parameter to an empty string and passed it to the App Service API_KEY setting.

With API_KEY empty, the API key middleware lets every request through, and the HTTP listener binds to 0.0.0.0 by default.

Unless the deployer set a key or added network restrictions, anyone on the internet could send JSON-RPC tools/call requests to /mcp. The read-only mode does not block anonymous use of the search and lookup tools (search, get_object_info, find_references and others), which expose indexed proprietary X++ source and metadata.

02.

How to check

Check whether you deployed d365fo-mcp to Azure with the one-click template, and which version (1.10.1 and earlier are affected).
Check the App Service's API_KEY setting; if it is empty, the endpoint is open.
Try a request to /mcp from outside your network without a key; it should be refused.

03.

How to fix

Upgrade to d365fo-mcp 1.11.0 or later.
Set a long random API_KEY on the App Service, and restrict access with Azure network rules or an authenticating front door.
If the endpoint was open, assume the indexed X++ code and metadata were readable by others.

az webapp config appsettings set -g <resource-group> -n <app-name> --settings API_KEY=$(openssl rand -hex 32)

04.

Sources

More advisories for this tool