Database/Container, Kubernetes & orchestration

Azure Kubernetes Configuration Service: missing authentication on a critical function allows remote privilege escalation

CVSS 10.0CVE-2026-83938Container, Kubernetes & orchestrationcurated

Impact

A critical function in the Azure Kubernetes Configuration Service - the control plane behind cluster extensions and GitOps configuration on AKS and Arc-connected clusters - was reachable without authentication, allowing an unauthorized network attacker to elevate privileges. That plane installs and configures workloads into clusters, which on a GPU fleet includes the components that grant device access, so privilege there reaches the clusters it configures rather than stopping at the service. Microsoft scores it 10.0 with changed scope. The MSRC entry gives no technical detail beyond the weakness class, and this is a Microsoft-operated service, so an operator cannot verify exposure independently.

Who can reach it

A remote network attacker against the Azure service endpoint, with no authentication and no prior privilege per the record.

What to do

Nothing to install: this is a Microsoft-hosted service and Microsoft states it is fixed on their side, so no customer action is required and no cluster maintenance window is needed. If your clusters use GitOps or extension configuration, review installed extensions and configuration resources for changes you did not make, and check audit logs for the period before the fix.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-83938 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83938

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.