CVE-2026-21512: Azure DevOps Server SSRF Vulnerability

CVE-2026-21512 Overview

CVE-2026-21512 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure DevOps Server. The flaw allows an authenticated attacker with low privileges to coerce the server into issuing arbitrary network requests, enabling spoofing attacks across the network. The vulnerability is tracked under CWE-918: Server-Side Request Forgery and affects Azure DevOps Server 2022.2.0 across multiple patch levels. Microsoft published an advisory through the Microsoft Security Response Center.

Critical Impact

An authenticated attacker can abuse Azure DevOps Server to send forged requests to internal systems, leading to spoofing and unauthorized access to confidential resources reachable from the server.

Affected Products

• Microsoft Azure DevOps Server 2022.2.0 (base release and RC)
• Microsoft Azure DevOps Server 2022.2.0 Patch 2 through Patch 7
• Microsoft Azure DevOps Server (all listed CPE configurations)

Discovery Timeline

• 2026-02-10 - CVE-2026-21512 published to the National Vulnerability Database
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-21512

Vulnerability Analysis

The vulnerability resides in Azure DevOps Server functionality that issues outbound HTTP requests based on user-controllable input. An authenticated attacker with at least low-level access can supply a crafted URL or resource reference. The server then issues a request to that destination on behalf of the attacker.

Because the request originates from the Azure DevOps Server itself, it inherits the network position and trust relationships of that host. Attackers can reach internal services not exposed to the public network, including metadata endpoints, internal APIs, and adjacent management interfaces. The confidentiality impact is rated High, while integrity and availability remain unaffected.

The attack does not require user interaction and operates over the network. Exploitation is most useful for reconnaissance, credential capture from internal services, and spoofing requests to systems that trust the Azure DevOps Server.

Root Cause

The root cause is insufficient validation of URLs or destination identifiers that the server fetches on behalf of authenticated users. The application does not enforce a strict allowlist of permitted hosts or schemes. Requests to internal IP ranges, loopback addresses, and link-local metadata endpoints are not blocked before the server-side fetch executes.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with a valid low-privilege account submits a request containing a malicious URL to a vulnerable endpoint within Azure DevOps Server. The server processes the URL and initiates a request to the attacker-specified target. Responses or side-channel signals can leak information about internal services, enable enumeration of internal hosts, or facilitate spoofed actions against systems that authenticate clients based on source IP.

The vulnerability manifests in Azure DevOps Server components that perform outbound HTTP requests using user-supplied parameters. See the Microsoft Security Update for CVE-2026-21512 for component-level technical details.

Detection Methods for CVE-2026-21512

Indicators of Compromise

• Unexpected outbound HTTP or HTTPS connections from Azure DevOps Server hosts to internal IP ranges (RFC 1918), loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
• Authenticated user sessions submitting requests containing URL parameters that reference internal hostnames or IP literals.
• Anomalous spikes in outbound request volume from the Azure DevOps Server service account.

Detection Strategies

• Inspect Azure DevOps Server IIS and application logs for request parameters containing fully qualified URLs, particularly those targeting non-public destinations.
• Correlate authenticated user activity with outbound network flows from the server to identify request chains that indicate SSRF behavior.
• Apply network detection rules that flag connections from the Azure DevOps Server to metadata services and management subnets.

Monitoring Recommendations

• Enable verbose logging on Azure DevOps Server web tier and forward logs to a centralized analytics platform for retention and querying.
• Monitor service account behavior for deviations in outbound destinations, request rates, and response sizes.
• Alert on any access from Azure DevOps Server to cloud instance metadata endpoints or internal administrative interfaces.

How to Mitigate CVE-2026-21512

Immediate Actions Required

• Apply the security update referenced in the Microsoft Security Response Center advisory for Azure DevOps Server 2022.2.0.
• Audit all Azure DevOps Server accounts and revoke unnecessary low-privilege access until patching is complete.
• Restrict outbound network access from Azure DevOps Server hosts using host-based and network firewall rules.

Patch Information

Microsoft has released a security update for Azure DevOps Server 2022.2.0. Administrators should consult the Microsoft Security Update for CVE-2026-21512 for the specific patch package matching their installed version and apply it through standard Azure DevOps Server update procedures.

Workarounds

• Block outbound traffic from Azure DevOps Server to internal management subnets, loopback ranges, and cloud metadata IP addresses at the network perimeter.
• Enforce egress proxy filtering so that the server can reach only an explicit allowlist of required external destinations.
• Disable or restrict Azure DevOps Server features that fetch user-supplied URLs if they are not required for business operations.

# Example Windows Firewall rule to block outbound traffic to cloud metadata endpoint
New-NetFirewallRule -DisplayName "Block-AzDO-Metadata-Egress" `
  -Direction Outbound `
  -RemoteAddress 169.254.169.254 `
  -Action Block `
  -Profile Any