Home / Vulnerability Intelligence / CVE-2026-33980

CVE-2026-33980 - Vulnerability Analysis

HighCVSS: 8.3

Last Updated: March 27, 2026

Azure Data Explorer MCP Server - Injection

Published: March 27, 2026Updated: March 27, 2026Remote Exploitable

Overview

Azure Data Explorer MCP Server <= 0.1.1 contains a KQL injection caused by unsanitized interpolation of the "table_name" parameter in MCP tool handlers, letting attackers execute arbitrary KQL queries, exploit requires control over input parameter.

Severity & Score

Severity: High

CVSS Score: 8.3

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary KQL queries on the Azure Data Explorer cluster, potentially exposing or modifying sensitive data.

Mitigation

Update to a version after 0.1.1 that includes commit 0abe0ee55279e111281076393e5e966335fffd30 or the latest available version.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 27, 2026

🟠 CVE-2026-33980 - High (8.3) Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 con... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33980/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 27, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-33980
Severity: High
CVSS Score: 8.3
Type: nosql_injection
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-943

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

EPSS Score

0.0%Probability of exploitation in the next 30 days