CVE-2026-33980: Azure Data Explorer MCP Server SQLi Flaw

CVE-2026-33980 Overview

A KQL (Kusto Query Language) injection vulnerability has been identified in Azure Data Explorer MCP Server, a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL injection vulnerabilities in three MCP tool handlers: get_table_schema, sample_table_data, and get_table_details. The table_name parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster.

Critical Impact

Attackers can execute arbitrary KQL queries against Azure Data Explorer clusters, potentially accessing, modifying, or exfiltrating sensitive data through unsanitized input parameters in AI assistant interfaces.

Affected Products

• Azure Data Explorer MCP Server versions up to and including 0.1.1
• Systems using affected MCP tool handlers (get_table_schema, sample_table_data, get_table_details)
• AI assistants integrated with vulnerable ADX MCP Server instances

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33980 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33980

Vulnerability Analysis

This vulnerability is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), a query injection flaw that allows attackers to manipulate database queries by injecting malicious input. The vulnerability exists in the Azure Data Explorer MCP Server's handling of the table_name parameter across multiple MCP tool handlers.

The affected handlers—get_table_schema, sample_table_data, and get_table_details—construct KQL queries by directly interpolating user-supplied input using Python f-strings. This approach bypasses any form of input validation or parameterized query mechanisms, creating a direct injection point for malicious KQL syntax.

In the context of AI assistants, this vulnerability becomes particularly dangerous as prompt injection attacks against the AI agent could lead to automated exploitation. An attacker could craft malicious prompts that cause the AI assistant to send specially crafted table names containing KQL injection payloads, effectively using the AI as an unwitting attack vector.

Root Cause

The root cause is improper input validation and the use of string interpolation (f-strings) to construct KQL queries. The table_name parameter is directly concatenated into query strings without sanitization, parameterization, or validation against allowed characters or table name patterns. This allows special KQL syntax and operators to be injected and executed as part of the query.

Attack Vector

The attack is conducted over the network, requiring low-privileged access to interact with the MCP server interface. An attacker can exploit this vulnerability by supplying a malicious table_name value that includes KQL query syntax. When the vulnerable handlers process this input, the injected KQL commands are executed against the Azure Data Explorer cluster with the privileges of the MCP server connection.

The attack surface is expanded when AI assistants are involved, as prompt injection techniques can manipulate the AI into constructing and sending malicious table name parameters without direct user intervention. This creates a scenario where even indirect interaction with the system could lead to exploitation.

Detection Methods for CVE-2026-33980

Indicators of Compromise

• Unusual or malformed table name parameters in MCP server logs containing KQL operators or special characters
• Unexpected KQL query patterns in Azure Data Explorer audit logs that deviate from normal table schema or sample data operations
• Evidence of data exfiltration or unauthorized data access through ADX query logs
• Anomalous query execution times or resource consumption indicating injected complex queries

Detection Strategies

• Monitor Azure Data Explorer query logs for queries containing unexpected operators, functions, or multi-statement patterns originating from MCP server connections
• Implement input validation logging to capture and alert on table name parameters containing special characters such as semicolons, pipes, or KQL keywords
• Deploy application-level monitoring to detect f-string interpolation with user-controlled input in query construction patterns
• Utilize SentinelOne Singularity Platform to detect anomalous process behavior and query patterns indicative of injection attacks

Monitoring Recommendations

• Enable comprehensive audit logging on Azure Data Explorer clusters to capture all query activity
• Configure alerts for queries accessing multiple tables or using administrative functions from MCP server service accounts
• Implement real-time monitoring for AI assistant interactions that result in unusual database query patterns
• Review MCP server access logs regularly for signs of prompt injection or manipulation attempts

How to Mitigate CVE-2026-33980

Immediate Actions Required

• Update Azure Data Explorer MCP Server to a version containing commit 0abe0ee55279e111281076393e5e966335fffd30 or later
• Audit existing deployments for signs of exploitation by reviewing Azure Data Explorer query logs
• Implement network segmentation to limit access to MCP server endpoints
• Temporarily disable or restrict access to the affected tool handlers (get_table_schema, sample_table_data, get_table_details) until patched

Patch Information

The vulnerability has been addressed in commit 0abe0ee55279e111281076393e5e966335fffd30. Organizations should update to a version containing this fix. For detailed patch information, refer to the GitHub Commit Update and the GitHub Security Advisory.

Workarounds

• Implement a whitelist-based input validation layer that restricts table name parameters to alphanumeric characters and underscores only
• Deploy a web application firewall (WAF) or API gateway with rules to block KQL injection patterns in request parameters
• Use network-level access controls to restrict which clients can interact with the MCP server endpoints
• Consider implementing parameterized query patterns at the application level as an additional defense layer

# Example: Verify patched version is deployed
# Check the current commit hash of your deployment
cd /path/to/adx-mcp-server
git log --oneline -1
# Ensure output includes commit 0abe0ee or a later commit