Database/Container, Kubernetes & orchestration
Azure Kubernetes Service: incorrect authorization lets an authorized attacker elevate privileges remotely
Impact
An authorization check in AKS was incorrect, letting an attacker who already holds some legitimate access elevate privileges over the network, with high confidentiality and integrity impact. On a GPU cluster that is the difference between a tenant's own namespace and the cluster-wide authority that can schedule onto any node and read any secret, including the credentials that reach shared storage and the model registry. Microsoft's entry gives only the weakness class and does not say which API surface or which privilege boundary was crossed, so an operator cannot scope it precisely. Kept separate from the Azure Kubernetes Configuration Service missing-authentication issue: different service, different weakness, different prerequisite.
Who can reach it
A remote attacker holding existing authorized access to the AKS surface - per the record no additional privilege is needed beyond that foothold.
What to do
Microsoft fixed this in the hosted service; no patch to roll out and no node drain or reboot. Confirm your clusters are on a current AKS version and, if they host untrusted or multi-tenant workloads, review RBAC bindings and audit logs for escalation attempts predating the fix.
References
Related entries
- containerd: CRI plugin propagates unvalidated image LABEL values into container configCVE-2026-53488 · containerdCritical
- Dokploy: registry password and URL interpolated unescaped into a swarm deploy commandCVE-2026-72879 · Dokploy registry credential handling (getRegistryCommands in cluster/upload.ts)Critical
- Kyverno: overlapping PolicyExceptions let a tenant bypass an enforce-mode policyCVE-2026-84200 · Kyverno admission controller (PolicyException handling)Critical
- Kyverno: 3DES cipher suites offered on TLS endpoints expose long-lived sessions to Sweet32CVE-2023-54356 · Kyverno TLS endpoints (3DES cipher suites)Critical
- kaniko: unanchored ACR hostname match leaks Azure identity tokens to a lookalike registryCVE-2026-105769 · kaniko (Azure Container Registry credential helper host matching)Critical
- Kyverno: generate rules are authorized against the controller's RBAC, not the policy author'sCVE-2026-122302 · Kyverno admission controller (generate-rule permission check)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.