Azure Pipelines: command injection allows unauthorized remote code execution (CVE-2026-105014)
Severity: high · Patch status: patched · Since 2026-10-22 · CVE-2026-105014
Microsoft disclosed CVE-2026-105014 on 22 October 2026: a command-injection flaw in Azure Pipelines that lets an unauthenticated attacker run code over the network, rated 9.1 with the full confidentiality and integrity impact of a build-system compromise. Microsoft reports no exploitation and no public disclosure, and fixes the service on its own side, so there is no version to pin or patch yourself. The consequence for defenders is downstream: a compromised pipeline can execute in your build agents, read your source, and use the service connections those pipelines hold. Treat any unexplained pipeline run, changed variable group or new service connection as worth investigating.
What to do
- No version to pin: Microsoft fixed this in the service. Confirm your tenant has received the October 2026 update through Azure Service Health rather than a patch calendar
- Review Azure Pipelines run history and audit logs for runs, agent jobs or service-connection uses nobody authorised
- Rotate pipeline service connections, PATs and deployment credentials if you find unexplained runs, then re-scope them to least privilege
- Reduce the blast radius: keep production service connections behind approvals and separate from pipelines that build untrusted pull requests
Sources
All live incidents on Threat Watch
