CVE-2026-58201

Lokka, an open-source Model Context Protocol (MCP) server for Microsoft 365, contains a server-side request forgery-style URL parsing flaw (CWE-918) in its Lokka-Microsoft tool: prior to version 2.1.2, the code in src/mcp/src/main.ts appends a user-controlled path value to the management.azure.com base URL using direct string concatenation. A crafted path containing characters that alter URL authority parsing can redirect the outgoing request to an attacker-controlled host, and the Azure Resource Manager bearer token attached for authentication is then sent to that host. An attacker able to influence the path value — for example via a malicious or compromised MCP client, untrusted tool input, or injected prompt content — obtains the victim's ARM bearer token, resulting in high confidentiality impact against the associated Azure/Microsoft 365 resources. Anyone running Lokka prior to 2.1.2 with Azure authentication is affected, and the issue is fixed in version 2.1.2. No public proof-of-concept is known, there is no evidence of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog.

What to do: Upgrade Lokka to version 2.1.2 or later, which fixes the unsafe URL construction in the Lokka-Microsoft tool. If older versions were used with untrusted clients or content, revoke and reissue the Azure credentials/tokens used by the server and review Azure sign-in and ARM audit logs for token use from unexpected hosts. Apply least-privilege permission scopes to any tokens granted to the MCP server to limit the blast radius of a leaked bearer token.