Unauthenticated Access Vulnerability in D365 F&O MCP Server by Dynamics 365

CVE-2026-114123

What is CVE-2026-114123?

The D365 F&O MCP Server before version 1.11.0 allows unauthenticated access due to an improperly configured API_KEY. This results in sensitive exposure, including proprietary X++ coding information. If the apiKey parameter is left empty during deployment, the server bypasses authentication, enabling attackers to query sensitive metadata without restrictions. Such queries can disclose critical business logic and security structure details, putting the integrity of diverse deployments at risk. The vulnerability has been addressed in version 1.11.0, which enhances security by requiring a configured API key or effective upstream authentication.

References