A safety researcher claims Microsoft quietly mounted an Azure Backup for AKS vulnerability after rejecting his report, and blocking a CVE from being issued.
The researcher’s report describes a essential privilege escalation flaw that allowed cluster-admin entry from the low-privileged “Backup Contributor” function.
Microsoft disputes the declare, telling BleepingComputer the habits was anticipated and that “no product adjustments had been made,” regardless of the researcher documenting new permission checks and failed exploit makes an attempt after disclosure, suggestive of a silent patch.
CERT agrees it is a bug, however Microsoft blocks CVE
Safety researcher Justin O’Leary found the safety flaw this March, and reported it to Microsoft on March 17.
Microsoft Safety Response Middle (MSRC) rejected the report on April 13, claiming the difficulty solely concerned acquiring cluster-admin on a cluster the place “the attacker already held administrator entry,” a characterization O’Leary says misrepresents the assault fully.
“That is factually incorrect,” states the researcher.
“The vulnerability permits a person with zero Kubernetes permissions to achieve cluster-admin. The assault doesn’t require current cluster entry — it grants it.”
O’Leary additional says that Microsoft described the submission to MITRE as “AI-generated content material,” one thing he says didn’t handle the technical deserves of the report.
After the rejection, O’Leary escalated the difficulty to CERT Coordination Middle, which independently validated the vulnerability on April 16 and, in accordance with the researcher, assigned it an identifier, VU#284781:
(Justin O’Leary)
CERT/CC had initially scheduled public disclosure for June 1, 2026, however that disclosure by no means occurred.
On Could 4, Microsoft workers reportedly contacted MITRE recommending in opposition to CVE project, once more arguing the difficulty required pre-existing administrative entry:
(Justin O’Leary)
CERT/CC later closed the case underneath CNA hierarchy guidelines, successfully leaving Microsoft (which is a CNA) with ultimate authority over CVE issuance for its personal merchandise.
How the assault labored
Azure Backup for AKS makes use of Trusted Entry to grant backup extensions cluster-admin privileges inside Kubernetes clusters.
In accordance with O’Leary, the flaw allowed anybody with solely the Backup Contributor function on a backup vault to set off that Trusted Entry relationship with out already having Kubernetes permissions.
An attacker might allow backup on a goal AKS cluster, inflicting Azure to routinely configure Trusted Entry with cluster-admin privileges. From there, an attacker might extract secrets and techniques via backup operations or restore malicious workloads into the cluster.
O’Leary labeled the difficulty as a Confused Deputy vulnerability (CWE-441), the place Azure RBAC and Kubernetes RBAC belief boundaries interacted in a way that bypassed anticipated authorization controls.
Microsoft says no adjustments made, habits says in any other case
BleepingComputer reached out to Microsoft to know if the tech big thought of this discovering to be a sound safety vulnerability.
A Microsoft spokesperson instructed BleepingComputer:
“Our evaluation concluded that this isn’t a safety vulnerability, however slightly anticipated habits that requires pre-existing administrative privileges throughout the buyer’s atmosphere. Due to this fact, no product adjustments had been made to handle this report and no CVE or CVSS rating had been issued.”
Nonetheless, following the disclosure of his report this month, O’Leary noticed that the unique assault path not works.
“Present habits returns errors that didn’t exist in March 2026,” he states:
ERROR: UserErrorTrustedAccessGatewayReturnedForbidden
“The Trusted Entry function binding is lacking/has gotten eliminated”
In accordance with O’Leary, Azure Backup for AKS now requires Trusted Entry to be manually configured earlier than backup may be enabled, reversing the sooner habits the place Azure configured it routinely.
He additionally noticed further permission checks that had been absent throughout his authentic testing in March. The vault MSI now requires Reader permissions on each the AKS cluster and snapshot useful resource group, whereas the AKS cluster MSI requires Contributor permissions on the snapshot useful resource group.
In different phrases, the vulnerability seems to have been mounted, however Microsoft has neither issued a public advisory nor notified clients.
The visibility downside for defenders
With no CVE or advisory, defenders have little visibility into the publicity window or remediation timeline.
“Organizations that granted Backup Contributor between an unknown begin date and Could 2026 had been uncovered to privilege escalation,” writes the researcher.
“With no CVE, safety groups can not observe this publicity. Silent patching protects distributors, not clients.”
The case highlights a structural downside with no straightforward repair.
Disputes between safety researchers and main distributors over severity, exploitability, and disclosure have change into widespread in recent times, particularly as vulnerability disclosure packages face rising volumes of stories.
Some open-source maintainers have additionally publicly complained that AI-assisted stories are overwhelming bug bounty and safety triage methods, making it tougher for professional findings to obtain well timed consideration. Instances the place huge tech ignored patching legitimate flaws regardless of repeated contact by totally different researchers will not be unusual both.
With no framework that realigns incentives for all events, accountable disclosure dangers changing into a bureaucratic train that serves nobody—least of all of the organizations left uncovered at the hours of darkness.
Automated pentesting instruments ship actual worth, however they had been constructed to reply one query: can an attacker transfer via the community? They weren’t constructed to check whether or not your controls block threats, your detection guidelines fireplace, or your cloud configs maintain.
This information covers the 6 surfaces you truly have to validate.
