Azure DevOps Unauthenticated Information Disclosure — Maximum CVSS 10

A network-accessible, zero-authentication flaw lets any attacker extract sensitive data from your Azure DevOps environment. No credentials. No interaction. Patch immediately.

Vulnerability Mechanism

CVE-2026-42826 arises from an access control breakdown in Azure DevOps that allows an unauthenticated attacker to reach internal API endpoints or storage paths that expose sensitive organisational data. The flaw does not require authentication at any stage — an attacker needs only network-level reachability to the Azure DevOps service.

The Changed Scope (S:C) designation is the critical differentiator here. It signals that a successful exploit can affect resources outside the directly vulnerable component — in Azure DevOps’ case, this could mean downstream pipelines, connected Azure subscriptions, or secret stores (Key Vault references, pipeline variables, service connection credentials) that are accessible via the extracted data.

The simultaneous rating of High Integrity and Availability impact alongside Confidentiality (C:H/I:H/A:H) implies the exposed information likely includes credentials, tokens, or PATs (Personal Access Tokens) with write privileges — enabling an attacker to pivot from data exposure to active manipulation or service disruption.

Attack Chain

// ─────────────────────────────────────────────────────────────────────────
// CVE-2026-42826 | Azure DevOps Unauthenticated Information Disclosure
// Hunt for suspicious anonymous or unauthenticated API access patterns
// targeting Azure DevOps REST endpoints.
// Author: Sujit Mahakhud | secbyte.in | May 2026
// ─────────────────────────────────────────────────────────────────────────

AzureDevOpsAuditing
| where TimeGenerated >= ago(24h)
| where Area == "REST" or Area == "API"
// Flag anonymous/unauthenticated calls — PR:N is the core exploit condition
| where AuthenticationMechanism in~ ("Anonymous", "None", "")
    or ActorUPN == ""
    or ActorUPN has "anonymous"
// Focus on high-value endpoints that would expose secrets/configs
| where Details has_any (
    "variablegroups", "serviceendpoints", "repositories",
    "pipelines", "builds", "tokens", "settings"
)
// Enrich with caller IP for threat intel correlation
| extend
    CallerIP     = tostring(Data.RemoteIP),
    Endpoint     = tostring(Data.RequestUrl),
    HttpMethod   = tostring(Data.HttpMethod),
    ResponseCode = tostring(Data.HttpStatus)
// Successful responses from unauth'd callers are the key signal
| where ResponseCode startswith "2"
| summarize
    TotalHits    = count(),
    Endpoints    = make_set(Endpoint, 20),
    FirstSeen    = min(TimeGenerated),
    LastSeen     = max(TimeGenerated)
    by CallerIP, HttpMethod, ActorUPN, OperationName
| where TotalHits >= 3   // Reduce noise; tune threshold per environment
| extend
    RiskScore = case(
        TotalHits > 20, "HIGH",
        TotalHits > 5,  "MEDIUM",
                        "LOW"
    )
| project
    LastSeen, FirstSeen, CallerIP, HttpMethod,
    OperationName, TotalHits, RiskScore, Endpoints
| order by TotalHits desc

// ─── Supplemental: Correlate with ThreatIntelligenceIndicator ───────────────
// Uncomment to enrich CallerIP against Microsoft Sentinel Threat Intelligence
// | join kind=leftouter (
//     ThreatIntelligenceIndicator
//     | where TimeGenerated >= ago(7d) and Active == true
//     | project TI_IP = NetworkIP, ThreatType, ConfidenceScore
// ) on $left.CallerIP == $right.TI_IP

📌 Deployment note: Requires the AzureDevOpsAuditing table — enable via Azure DevOps Organisation Settings → Auditing → Stream to Log Analytics Workspace. Adjust the TotalHits ≥ 3 threshold and the endpoint keyword list to match your environment’s normal traffic profile before deploying as an Analytics Rule.

• 
  🔗 Microsoft Security Response Center — CVE-2026-42826 Advisory
  
  Official MSRC advisory with patch links and severity details
• 
  🔗 TheHackerWire — Azure DevOps Critical Information Disclosure (CVE-2026-42826)
  
  Technical write-up and impact analysis
• 
  🔗 Vulnerability-Lookup — MSRC CVE-2026-42826
  
  CIRCL vulnerability database entry with CVSS vector details