CVE-2026-33980
Pab1It0 Azure Data Explorer Mcp Server ≤ 0.1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LSummary
CVE-2026-33980 is a high-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Pab1It0 Azure Data Explorer Mcp Server. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Azure Data Explorer MCP Server, a Model Context Protocol (MCP) server that allows AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases via standardized interfaces, contains KQL injection vulnerabilities in versions up to and including 0.1.1. The flaws affect three MCP tool handlers—get_table_schema, sample_table_data, and get_table_details—where the table_name parameter is directly interpolated into KQL queries using f-strings without validation or sanitization. This enables attackers to inject and execute arbitrary KQL queries against the connected Azure Data Explorer cluster. The vulnerability is rated with a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) and is associated with CWE-943.
Attackers with low privileges (PR:L) can exploit this over the network with low complexity and no user interaction required. Exploitation occurs by supplying a malicious table_name value, potentially through direct access to the MCP server or via a prompt-injected AI agent interacting with the tools. Successful attacks allow arbitrary KQL query execution, enabling high confidentiality and integrity impacts such as data exfiltration, modification, or limited denial of service, depending on the attacker's permissions within the Azure Data Explorer cluster.
The patching commit 0abe0ee55279e111281076393e5e966335fffd30 addresses the issue by fixing the injection flaws in the affected handlers. Security practitioners should update to a version incorporating this commit, as detailed in the GitHub security advisory GHSA-vphc-468g-8rfp.
This vulnerability has particular relevance to AI/ML deployments, as it targets an MCP server designed for AI assistants, highlighting risks of prompt injection leading to database compromise in agentic AI workflows. No public evidence of real-world exploitation is available as of publication on 2026-03-27.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16878
Vulnerability Data
Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kusto Query…
more
Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster. Commit 0abe0ee55279e111281076393e5e966335fffd30 patches the issue.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, mcp, model context protocol
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops unneutralized special elements from reaching query logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require parameterized queries and input neutralization to prevent query-logic injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches injection vulnerabilities before release but does not itself implement the fix.
Secure development life cycle mandates input validation and query parameterization that directly prevent injection flaws.
Application security requirements explicitly call for controls against injection and improper query construction.
Secure architecture principles reduce the likelihood of query-logic flaws but do not prescribe the specific coding practice.
Secure coding standards require proper neutralization of special elements in all data queries.
Outsourced development agreements can require secure coding practices, indirectly mitigating the weakness.