Reported by 1 outlet
Microsoft silently patches critical Azure Backup for AKS privilege escalation, blocks CVE issuance
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Microsoft silently patches critical Azure Backup for AKS privilege escalation, blocks CVE issuance
bleepingcomputer.com · 150d ago · May 17th, 2026
Security researcher Justin O'Leary has disclosed a critical privilege escalation flaw in Azure Backup for AKS that Microsoft rejected, silently patched, and actively blocked from receiving a CVE — exposing a structural transparency problem in responsible disclosure. The vulnerability allowed anyone with the low-privileged "Backup Contributor" role on an Azure Backup vault to gain cluster-admin inside Kubernetes clusters through Trusted Access auto-configuration, requiring zero pre-existing Kubernetes permissions. O'Leary reported the flaw to Microsoft on March 17; MSRC rejected it on April 13, claiming it "required pre-existing administrative access," a characterization O'Leary calls "factually incorrect." CERT/CC independently validated the vulnerability (VU#284781) on April 16, but Microsoft then recommended MITRE against CVE assignment, and CERT/CC closed the case under CNA hierarchy rules. After public disclosure, O'Leary confirmed the original attack path no longer works — Azure Backup now requires manual Trusted Access configuration, and new permission checks block the escalation path. Microsoft maintains "no product changes were made." The incident underscores how CNA authority gives vendors effective veto power over vulnerability disclosure for their own products, leaving defenders without CVE tracking, advisory notification, or visibility into the exposure window.