Azure Backup Aks Silent Patch

In March 2026, I discovered a privilege escalation vulnerability in Azure Backup for AKS that allowed a user with only the “Backup Contributor” Azure role (zero Kubernetes permissions) to gain cluster-admin on any AKS cluster.

CERT/CC validated this finding as VU#284781 on April 16, 2026.

Microsoft rejected it, claiming the “attacker already held administrator access.” This was factually incorrect — the vulnerability grants cluster-admin, it does not require it.

On May 12, 2026, I confirmed Microsoft has silently patched the behavior without:

CERT/CC independently validated this vulnerability and assigned VU#284781. The case was scheduled for public disclosure on June 1, 2026.

On May 4, 2026, Microsoft’s Lisa Olson emailed MITRE recommending no CVE be assigned. The email contains a false claim that “the attacker already held administrator access to the cluster.”

This is factually incorrect. The vulnerability allows a user with zero Kubernetes permissions to gain cluster-admin. The attack does not require existing cluster access — it grants it.

Microsoft also claimed the report was “AI-generated content” — an ad hominem deflection that does not address the technical validity of the finding.

Two days later, on May 6, 2026, CERT/CC closed the case, citing CNA hierarchy rules.

The closure came despite CERT/CC having already validated the vulnerability and assigned VU#284781. The case remains marked as INACTIVE in VINCE:

Azure Backup for AKS uses Trusted Access to grant the backup extension cluster-admin privileges. The vulnerability allowed a user with only Backup Contributor (an Azure RBAC role with zero Kubernetes permissions) to trigger this access grant.

This crossed the trust boundary between Azure RBAC and Kubernetes RBAC — a Confused Deputy vulnerability (CWE-441).

CVSS 3.1: 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Current behavior returns errors that did not exist in March 2026:

The system now requires Trusted Access to be manually configured before backup can be enabled — the opposite of the vulnerable behavior I reported.

Additional permission checks were also added:

These validation checks did not exist during my original testing in March 2026. The original attack path is now blocked.

The coordinated disclosure process failed:

Organizations that granted Backup Contributor between an unknown start date and May 2026 were exposed to privilege escalation. Without a CVE, security teams cannot track this exposure.

Silent patching protects vendors, not customers.