CVE-2026-58201: Lokka: Azure Resource Manager URL path validation issue
Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially crafted path can alter URL authority parsing and cause an Azure Resource Manager bearer token to be sent to an unintended host. This issue is fixed in version 2.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lokkato a version that resolves this vulnerability.Fixed in 2.1.2
Event History
Frequently Asked Questions
Which deployments are affected?
Lokka deployments using a version earlier than 2.1.2 are affected where the Lokka-Microsoft tool is available and can process a user-controlled Azure Resource Manager path value.
What does an attacker need to exploit this issue?
An attacker needs to supply a specially crafted path to the Lokka-Microsoft tool. The crafted path must cause URL authority parsing to direct the request, and the Azure Resource Manager bearer token, to an unintended host.
What is the remediation?
Upgrade Lokka to version 2.1.2, which fixes the URL path validation issue.