CVE-2026-58201 Overview
CVE-2026-58201 is a Server-Side Request Forgery (SSRF) vulnerability in Lokka, a Model Context Protocol (MCP) server for Microsoft 365, Microsoft Graph, and related Azure services. The flaw affects the Lokka-Microsoft tool in src/mcp/src/main.ts, where user-supplied path values are concatenated directly to the management.azure.com base URL. A crafted path can manipulate URL authority parsing and redirect an Azure Resource Manager (ARM) bearer token to an attacker-controlled host. The issue is fixed in version 2.1.2.
Critical Impact
An attacker can exfiltrate a valid Azure Resource Manager bearer token to an unintended host, enabling unauthorized access to Azure resources bound to that identity.
Affected Products
- Lokka MCP server versions prior to 2.1.2
- The Lokka-Microsoft tool in src/mcp/src/main.ts
- Deployments integrating Lokka with Microsoft Graph and Azure Resource Manager
Discovery Timeline
- 2026-09-15 - CVE-2026-58201 published to the National Vulnerability Database (NVD)
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-58201
Vulnerability Analysis
The Lokka MCP server exposes a Lokka-Microsoft tool that constructs Azure Resource Manager request URLs by concatenating a user-supplied path argument to the https://management.azure.com base string. Because the concatenation happens as plain string joining rather than through a URL parser, an attacker can inject characters that alter how the resulting URL's authority component is parsed.
When the assembled string is later handed to an HTTP client, the client may resolve the request to a host other than management.azure.com. Lokka still attaches the ARM bearer token acquired for the legitimate Azure API, so the token is transmitted to the attacker's host. This maps to CWE-918: Server-Side Request Forgery.
Root Cause
The root cause is unsafe URL composition. The Lokka-Microsoft handler treats the path parameter as trusted input suitable for direct concatenation. No validation enforces that the final request targets the management.azure.com origin, and no URL parsing library is used to reject inputs that would change the authority.
Attack Vector
The vulnerability is exploitable over the network without authentication or user interaction on the Lokka server itself. An attacker who can submit tool invocations to the MCP server, for example through an untrusted prompt fed to an AI agent using Lokka, supplies a crafted path value. The server issues an outbound HTTPS request that resolves to the attacker's host and includes the ARM bearer token in the Authorization header. The attacker then reuses that token against Azure Resource Manager APIs.
See the GitHub Security Advisory GHSA-g2gw-q38m-vjfc and the GitHub Pull Request Discussion for technical details.
Detection Methods for CVE-2026-58201
Indicators of Compromise
- Outbound HTTPS connections from Lokka hosts to destinations other than management.azure.com, graph.microsoft.com, and other expected Microsoft endpoints.
- Requests where the path parameter passed to the Lokka-Microsoft tool contains characters that influence URL authority parsing, such as @, \, or embedded schemes.
- Azure sign-in and ARM audit logs showing access-token use from unfamiliar source IPs shortly after Lokka activity.
Detection Strategies
- Inventory MCP servers and confirm the installed Lokka version; flag any instance below 2.1.2.
- Inspect Lokka application logs for Lokka-Microsoft invocations and record the raw path argument for review.
- Correlate Lokka tool-call telemetry with egress proxy logs to identify requests leaving the expected Microsoft API domains.
Monitoring Recommendations
- Route Lokka egress through an HTTP proxy that enforces an allowlist restricted to Microsoft API hostnames.
- Alert on Azure Resource Manager API calls that originate from IPs not associated with the Lokka deployment.
- Monitor Entra ID service principal token usage for anomalous geographic or ASN patterns.
How to Mitigate CVE-2026-58201
Immediate Actions Required
- Upgrade Lokka to version 2.1.2 or later on all MCP server deployments.
- Rotate any Azure Resource Manager credentials and service principal secrets used by Lokka that may have been exposed.
- Review Azure activity logs for unauthorized ARM API calls tied to the Lokka identity.
Patch Information
The fix is available in Lokka 2.1.2. The maintainer replaced unsafe URL concatenation with parsed URL construction that preserves the intended authority. Review the GitHub Commit Overview and the GitHub Security Advisory GHSA-g2gw-q38m-vjfc for the full remediation details.
Workarounds
- Restrict Lokka network egress to an allowlist of Microsoft API hostnames using a forward proxy or firewall policy.
- Limit the Azure role assignments granted to the Lokka service principal to the minimum required scope.
- Disable or gate the Lokka-Microsoft tool until patched, particularly in agents that accept untrusted prompts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.