Azure DevOps CLI Extension: Information disclosure due to origin validation error
Summary
Microsoft's Azure CLI and the Azure DevOps CLI Extension contain an origin validation error (CWE-346) that allows an unauthorized attacker on the network to disclose sensitive information. According to the vendor, the exposed data could include a sign-in access token for a user's work account, which could grant access to data and services that user is authorized to use. Exploitation requires a user to take an action (UI:R). No public proof-of-concept or known exploitation exists, and the vendor rates exploitation as less likely.
Affected
- Azure CLI: version ranges in the sources conflict and could not be verified; check the MSRC advisory.
- Azure DevOps CLI Extension: one third-party source indicates 1.0.6 up to (not including) 1.0.7; not confirmed by the vendor.
Fixed in
Unknown. The vendor advises upgrading to the latest Azure CLI and Azure DevOps CLI Extension releases that contain the fix. Check the MSRC advisory for the exact fixed builds.
Workaround
No workaround documented. As an interim measure, limit who can run these CLI tools and avoid storing long-lived tokens in shared or CI environments.
Exploitation
- Vendor: not publicly disclosed, not known to be exploited, exploitability rated as less likely.
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- EPSS about 0.4%.
- No public proof-of-concept known.
Our recommendation
- Open the MSRC advisory and record the exact fixed builds for Azure CLI and the Azure DevOps CLI Extension.
- Inventory all installations, including developer laptops and CI build agents.
- Update affected installations within the normal patch cycle.
- Rotate sign-in tokens used from affected installations, since token theft can be quiet.
- Re-check NVD for final version data once analysis is complete.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center advisory CVE-2026-69877 msrc.microsoft.com
- OpenCVE CVE-2026-69877 app.opencve.io
- Vulners CVELIST CVE-2026-69877 vulners.com
- Vulners NVD CVE-2026-69877 vulners.com
- Strix CVE-2026-69877 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 11:27.
Original description (NVD)
Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.