What happened
Verified on the fix commit (fetched): the security guard was gated on NODE_ENV rather than on whether authentication exists or the bind is public, so documented non-one-click deployments shipped keyless and exposed. The fix makes forget-the-key cost reachability rather than secrecy.
Why it matters
One-click cloud templates and MCP connectors are trusted deployment shortcuts; an MCP server exposing Dynamics 365 F&O metadata unauthenticated leaks sensitive ERP code, configurations and business data to any network peer.
Attack vector
The startup guard added for GHSA-8764-fh3m-wf7g only fired when NODE_ENV=production; the Bicep template sets that variable for one-click, but the documented pipeline path sets different variables and neither NODE_ENV nor API_KEY, so the exposed server binds a public interface with no API key — unauthenticated network access to ERP metadata/querying MCP tools.
Affected systems
d365fo-mcp-server < 1.11.0 (D365 F&O MCP Server, Azure one-click / pipeline deployment paths)
Mitigation
Upgrade to ≥1.11.0 (commit 384394a fixes the guard to key on bind address: keyless servers now bind 127.0.0.1, or refuse to start on a public interface); explicitly set API_KEY or ALLOW_UNAUTHENTICATED if a public bind is intended.