{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0009",
  "aliases": [
    "CVE-2026-32211"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-19T00:00:00Z",
  "summary": "Azure MCP Server package identity and release need grounding",
  "details": "## What the vulnerability is\n\nThis record is a provisional package-specific advisory for an Azure MCP Server claim. The affected component is represented as the npm package `@azure/mcp`, with a tentative fixed release of `1.0.0`; the current references do not establish the package identity and release boundary well enough to state the underlying vulnerability mechanism as settled.\n\n## Which configuration is exposed\n\nThe matcher exposes any MCP server entry whose package is `pkg:npm/@azure/mcp`. It does not require a harness, transport, URL, server name, or resolved version. That means the combination making the rule match is simply a configured server with this package identity; the matcher cannot distinguish a vulnerable release from a fixed one.\n\n## How ACVE detects it\n\nACVE reads `mcpServers[].package` and compares it with the tentative PURL. It does not read `mcpServers[].resolvedVersion`, verify the registry that supplied the package, or inspect the server's tools. A package launched through `npx` may also have an unknown resolved version, so the finding is reported as *possible* until the package and release are grounded.\n\n## Fix\n\n1. Run grounding to confirm the Azure package name, PURL, affected range, and fixed release.\n2. After confirmation, upgrade the matching MCP package to the documented fixed release and refresh the lockfile.\n3. Until then, remove or disable the server if it is not required.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the package name and PURL, the fixed release, and that `CVE-2026-32211` aliases this Azure MCP Server issue. The current `1.0.0` boundary is (unverified — see Grounding needed).\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@azure/mcp"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "MCP",
        "name": "pkg:npm/@azure/mcp"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32211"
    },
    {
      "type": "REPORT",
      "url": "https://azure.microsoft.com/en-us/updates/"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2026-32211"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "5"
    }
  ],
  "database_specific": {
    "severity": "MODERATE",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "vulnClasses": [
        "supply-chain"
      ],
      "cwe": [
        "CWE-829"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI08 Supply Chain Vulnerabilities"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "some": "mcpServers",
        "where": {
          "field": "package",
          "op": "eq",
          "value": "pkg:npm/@azure/mcp"
        }
      },
      "fix": {
        "summary": "Ground the Azure MCP package identity, then upgrade to its confirmed fixed release.",
        "actions": [
          {
            "type": "upgrade",
            "target": "mcp:pkg:npm/@azure/mcp",
            "to": "1.0.0",
            "why": "Use the fixed release."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:29Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:29Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:29Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:29Z",
          "confirmed": [
            "npm:@azure/mcp@1.0.0"
          ],
          "missing": []
        }
      }
    }
  }
}