A critical KQL injection vulnerability in the adx-mcp-server allows authenticated users or compromised AI agents to execute arbitrary queries against Azure Data Explorer clusters.

The application fails to sanitize the table_name parameter before interpolating it into KQL queries within the get_table_schema, sample_table_data, and get_table_details handlers. This allows a low-privileged authenticated user or a manipulated AI agent to perform KQL injection, potentially leading to unauthorized data access or modification.

The vulnerability carries a CVSS score of 8.3, indicating a high risk of sensitive data exposure and potential integrity loss within the connected Azure Data Explorer databases. Successful exploitation could allow an attacker to bypass data access controls, leading to unauthorized retrieval of proprietary information or disruption of database services.

Immediate Action: As no formal release version contains a patch, users should immediately restrict access to the affected MCP server and apply the fix manually using the provided upstream commit 0abe0ee55279e111281076393e5e966335fffd30.

Proactive Monitoring: Review Azure Data Explorer query logs for unusual or unauthorized KQL patterns, specifically monitoring for unexpected access to schemas or tables by the MCP service identity.

Compensating Controls: Implement strict identity and access management (IAM) policies on the Azure Data Explorer cluster to ensure the service principal associated with the MCP server has the absolute minimum permissions required for operation.

Public Exploit Available: Yes, a public proof-of-concept repository is available on GitHub (romain-deperne/CVE-2026-33980).

Given the high severity and the availability of a public proof-of-concept, organizations utilizing the adx-mcp-server must prioritize the application of the upstream code fix. Until the patch is verified and deployed, limit the exposure of the AI assistant interfaces to trusted users only to minimize the risk of malicious prompt injection.