CVE-2026-33107
This vulnerability is a server‑side request forgery in Azure Databricks that lets an attacker send requests to internal resources. Because the attacker can make the server reach any network address, they can gain higher privileges on the platform. The flaw is critical and can be exploited without authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Azure Databricks (all versions).
Real-world impact
An attacker could use the flaw to make Azure Databricks reach internal services, potentially gaining elevated privileges and accessing sensitive data or controlling resources.
Why this severity
The CVSS score of 10 reflects that the attack can be performed over the network (AV:N), requires no user interaction (UI:N), and gives the attacker full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The attack is easy (AC:L) and needs no privileges (PR:N).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.
Timeline
- Apr 3, 2026 · Apr 3, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory