CVE-2026-114123: D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet
D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service APIKEY setting. With APIKEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCPSERVERMODE=read-only setting does not prevent anonymous access to read/search tools, including search, getobjectinfo, batchgetinfo, extensioninfo, securityinfo, findreferences, and findeventhandlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
D365 F&O MCP Serverto a version that resolves this vulnerability.Fixed in 1.11.0 - Configuration
Configure a non-empty API_KEY for the App Service deployment; leaving the optional key blank permits unauthenticated access.
D365 F&O MCP Server API_KEY = non-empty configured API key
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments made with the documented Azure one-click templates are exposed when the optional apiKey is left blank and no separate network restrictions or upstream authentication are configured. The server binds its HTTP listener to 0.0.0.0 by default, allowing a public App Service to accept requests.
What does an attacker need to exploit this issue?
No credentials, privileges, or user interaction are required if API_KEY is unset or empty and the service is publicly reachable. An attacker can send unauthenticated JSON-RPC tools/call requests to the /mcp endpoint.
Does read-only mode prevent disclosure?
No. MCP_SERVER_MODE=read-only does not block anonymous use of read and search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers.
What should be checked and changed immediately?
Check whether the App Service API_KEY setting is unset or empty and whether the /mcp endpoint is publicly reachable without upstream authentication or network restrictions. Set a non-empty API key and restrict network access or apply upstream authentication; versions before 1.11.0 are affected.