CVE-2026-69877 - Vulnerability Details - OpenCVE

Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Microsoft	Azure Cli Azure Command-line Interface Azure Devops Cli Extension

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69877

History

Sun, 18 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft azure Cli
Vendors & Products		Microsoft azure Cli

Wed, 14 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Oct 2026 19:15:00 +0000

Type	Values Removed	Values Added
Description		Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
Title		Azure DevOps Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft azure Command-line Interface Microsoft azure Devops Cli Extension
Weaknesses		CWE-346
CPEs		cpe:2.3:a:microsoft:azure_command-line_interface:::::::: cpe:2.3:a:microsoft:azure_devops_cli_extension::::::::
Vendors & Products		Microsoft Microsoft azure Command-line Interface Microsoft azure Devops Cli Extension
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69877
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-10-13T19:00:12.572Z

Updated: 2026-10-23T22:24:22.553Z

Reserved: 2026-08-03T22:53:31.650Z

Link: CVE-2026-69877

Vulnrichment

Updated: 2026-10-13T21:07:16.992Z

NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:19:00.750

Modified: 2026-10-13T22:17:46.107

Link: CVE-2026-69877

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-69877", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-08-03T22:53:31.650Z", "datePublished": "2026-10-13T19:00:12.572Z", "dateUpdated": "2026-10-23T22:24:22.553Z"}, "containers": {"cna": {"title": "Azure DevOps Information Disclosure Vulnerability", "datePublic": "2026-10-13T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:azure_command-line_interface:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "1.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:azure_devops_cli_extension:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.6", "versionEndExcluding": "1.0.7"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Azure CLI", "versions": [{"version": "2.0.0", "lessThan": "1.0.7", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Azure DevOps CLI Extension", "versions": [{"version": "1.0.6", "lessThan": "1.0.7", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-346: Origin Validation Error", "lang": "en-US", "type": "CWE", "cweId": "CWE-346"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-10-23T22:24:22.553Z"}, "references": [{"name": "Azure DevOps Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69877"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-69877", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T21:07:16.364571Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T21:15:24.257Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-69877", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T21:07:16.364571Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T21:07:16.992Z"}}], "cna": {"title": "Azure DevOps Information Disclosure Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Azure CLI", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "1.0.7", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Azure DevOps CLI Extension", "versions": [{"status": "affected", "version": "1.0.6", "lessThan": "1.0.7", "versionType": "custom"}]}], "datePublic": "2026-10-13T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69877", "name": "Azure DevOps Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:azure_command-line_interface:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.7", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:microsoft:azure_devops_cli_extension:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.7", "versionStartIncluding": "1.0.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-10-23T22:24:22.553Z"}}}, "cveMetadata": {"cveId": "CVE-2026-69877", "state": "PUBLISHED", "dateUpdated": "2026-10-23T22:24:22.553Z", "dateReserved": "2026-08-03T22:53:31.650Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-10-13T19:00:12.572Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}