MCPwned -- Azure MCP Server SSRF & Cloud Takeover (CVE-2026-26118)
Date: 2026-03
Affected: MCPwned
Attack vector: rce
Category: real-world
Severity: Critical
CVE: CVE-2026-26118
CWE: CWE-918
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

SSRF vulnerability (CVSS 8.8) in Azure MCP Server Tools allowed stealing managed identity tokens via malicious URLs submitted in place of Azure resource identifiers. Attackers could impersonate the server's identity and access Azure resources, compromising Azure and Entra ID tenants.


Mitigations:

Architectural layers (MAESTRO):