Critical Azure MCP Server Vulnerability Leaves Enterprise AI Agents Exposed

A critical CVSS 9.1 authentication flaw in Microsoft's Azure MCP Server can expose sensitive data and API keys without a patch currently available. The vulnerability exposes a fundamental design weakness in the MCP specification itself, which makes authentication optional rather than mandatory, leaving security to individual implementations. Teams deploying AI agents with Azure DevOps must implement network controls immediately, but this incident signals a broader ecosystem risk for production MCP deployments lacking baseline security controls.