Database/Container, Kubernetes & orchestration

Azure Kubernetes Service: missing authentication on a critical function allows remote privilege escalation

CVSS 10.0CVE-2026-56163Container, Kubernetes & orchestrationcurated

Impact

A critical function in AKS is reachable over the network without authentication, which Microsoft rates as remote privilege escalation with a scope change at CVSS 10.0. For an operator running GPU node pools on AKS this is a managed control plane defect: an unauthenticated network attacker gains elevated privileges over the cluster, which in a shared cluster means reach into other tenants' namespaces and onto GPU nodes that are expensive to cordon and recreate. The MSRC record gives no mechanism detail, so the specific function and the required network position are not established here.

Who can reach it

Unauthenticated attacker with network access, per Microsoft's vector (AV:N/PR:N/UI:N). The record does not say which endpoint is exposed or whether cluster API reachability is required.

What to do

Microsoft rates this as a service-side issue in AKS; check MSRC for CVE-2026-56163 for whether action is required on your clusters or whether the fix was applied in the managed control plane. If a node-image or AKS version upgrade is listed, that means a rolling node pool upgrade - drain and replace each GPU node - so plan the window accordingly. The record names no fixed version.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-56163 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56163

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.