CVE-2026-42826 — Azure DevOps Information Disclosure PoC

Overview

Vulnerability Description

Azure DevOps can serve pipeline configuration, variable group contents, and build artifacts to unauthenticated HTTP requests under certain conditions. A remote attacker sends crafted requests to the Azure DevOps REST API and receives JSON responses containing:

• Pipeline YAML configurations
• Variable group metadata (including names of secret variables)
• Service connection identifiers
• Build log fragments
• Repository contents

No credentials are required when the target project is configured for public visibility, or when an internal API endpoint fails to enforce authentication checks before returning data.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 10.0 Critical

Attack Vectors

1. Unauthenticated API Access (Public Projects)

Organizations with public projects enabled expose repos, pipelines, artifacts, and work items to the unauthenticated internet.

2. Authentication Bypass

Specific internal API endpoints fail to enforce authentication checks before returning sensitive data.

3. Pipeline YAML Reconnaissance

Public project pipeline YAML files reference service connections by name and variable groups by name, revealing Azure subscription structure, deployment targets, registry URLs, and environment names.

4. Service Connection Extraction

Service connection metadata (Azure subscription IDs, tenant IDs, Kubernetes cluster IDs) is exposed via the API.

5. Variable Group Harvesting

Non-secret variable values are visible in the UI, returned by the API, and printed to build logs.

6. Build Log Fragment Extraction

Build logs may contain sensitive configuration data, environment variables, and infrastructure details.

Files

Documentation

Usage

Quick Start (Unauthenticated Scan)

# Check if organization has publicly exposed projects
python3 exploit.py -u https://dev.azure.com/targetorg

Full Exploitation (With PAT)

# Full exploitation with Personal Access Token
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT_TOKEN

# Target specific project
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT --project MyProject

# Save report to file
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT -o report.json

On-Premises Azure DevOps Server

python3 exploit.py -u https://tfs.company.local/tfs/DefaultCollection --pat YOUR_PAT

Detection & Hardening Check

python3 detect.py -u https://dev.azure.com/targetorg --pat YOUR_PAT

Run Tests

python3 test_exploit.py

Impact

• Source code exfiltration: All repository contents accessible
• Credential exposure: Service connection names, Azure subscription IDs, tenant IDs
• Pipeline reconnaissance: YAML configs reveal infrastructure topology
• Variable harvesting: Non-secret variable values in plaintext
• Build log analysis: Sensitive data in log fragments
• Lateral movement planning: Infrastructure mapping for targeted attacks

Attack Flow Diagram

Attacker              Azure DevOps API
  │                         │
  │  GET /_apis/projects    │
  │  (no auth)              │
  │ ──────────────────────► │
  │                         │
  │  200 OK                 │
  │  { projects: [...] }    │
  │ ◄────────────────────── │
  │                         │
  │  GET /proj/_apis/       │
  │  pipelines              │
  │ ──────────────────────► │
  │                         │
  │  200 OK                 │
  │  { YAML configs }       │
  │ ◄────────────────────── │
  │                         │
  │  GET /proj/_apis/       │
  │  variablegroups         │
  │ ──────────────────────► │
  │                         │
  │  200 OK                 │
  │  { variables: {...} }   │
  │ ◄────────────────────── │
  │                         │
  │  Extract secrets,       │
  │  map infrastructure     │
  │                         │

See DIAGRAM.md for full architecture diagrams.

Mitigation

1. Set all projects to private — Disable public project visibility
2. Block public projects at org level — Set org policy to prevent future public projects
3. Mark all sensitive variables as secret — Non-secret variables are exposed via API
4. Restrict service connections — Disable "Allow all pipelines" on service connections
5. Use scoped PATs — Limit PAT scope to Code (Read) with 90-day expiry
6. Scan build logs — Remove sensitive data from log output
7. Apply security update — Azure DevOps Server 2026.0.1+

References

• NVD Entry
• GitHub Advisory GHSA-gmwx-3xm2-9fx8
• Microsoft Security Update Guide
• CWE-200

License

MIT