CVE-2026-58201 Details
Description
Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially crafted path can alter URL authority parsing and cause an Azure Resource Manager bearer token to be sent to an unintended host. This issue is fixed in version 2.1.2.
A vulnerability exists in Lokka, a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services, in versions prior to 2.1.2. The issue arises in the Lokka-Microsoft tool, where user-controlled path values are directly concatenated into URLs for Azure Resource Manager requests. This flaw allows for manipulation of URL authority parsing, potentially redirecting Azure Resource Manager bearer tokens to unintended hosts.
Users can upgrade to Lokka version 2.1.2 or later, where this vulnerability has been addressed by implementing proper path validation and using the URL standard library for safe URL construction.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/merill/lokka/commit/babead878f44cc2face2f8ee55d8b706e420947e | [email protected] | Source CodeVendor |
| https://github.com/merill/lokka/pull/47 | [email protected] | Issue TrackingVendor |
| https://github.com/merill/lokka/security/advisories/GHSA-g2gw-q38m-vjfc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| merill Lokka-Microsoft | < 2.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |