Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211) - ATR-2026-00435 (e06e06e0-3fd4-5914-a7b6-297d4cba602e)
Detects exploitation or configuration exposure of CVE-2026-32211 (CVSS 9.1 Microsoft / 7.5 NIST), missing authentication for critical function in Azure MCP Server allowing an unauthenticated attacker to disclose information over a network. Detects (a) MCP server config blocks pointing at Azure MCP endpoints without an auth / headers / token field, (b) raw MCP handshake responses from Azure MCP servers that expose tool listings without an Authorization challenge, and (c) skill/tool descriptions referencing the Azure MCP unauthenticated surface. CWE-306.