d365fo-mcp-server vulnerabilities

CVEs whose affected-version data names the d365fo-mcp-server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-114123High· 7.5

today

D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.js…

▾ Twilightdynamics365ninja · d365fo-mcp-servervia CVEORG