Executive brief
Lokka is a tool that integrates with Microsoft 365 and Azure services for the Model Context Protocol. Versions prior to 2.1.2 are vulnerable to token theft: an attacker can craft malicious path values that redirect Azure authentication tokens to an attacker-controlled server instead of the legitimate Azure management service, potentially compromising credentials and access to cloud resources.
Technical details
Lokka versions before 2.1.2 construct Azure Resource Manager request URLs by directly concatenating user-controlled path input without proper validation, allowing an attacker to inject URL authority components (CWE-918: Server-Side Request Forgery). By crafting specially malformed path values, an attacker can manipulate URL parsing to redirect bearer token requests intended for management.azure.com to an arbitrary attacker-controlled host. No authentication or user interaction is required; the vulnerability is triggered when Lokka processes the malicious path. The fix in version 2.1.2 validates Azure paths before token acquisition and uses the standard URL API to construct requests, ensuring the host remains management.azure.com.
Affected products
- merill Lokka < 2.1.2
Timeline
- 2026-06-19: disclosed
- 2026-06-19: patched: version 2.1.2 released