PT-2026-29906 · Microsoft · Azure Kubernetes Service

Amir Gombo · Published 2026-04-02 · Updated 2026-04-10 · CVE-2026-33105

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service (affected versions not specified)

Description Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. The flaw allows unauthenticated attackers to escalate privileges remotely. The scope of the issue allows attackers to potentially affect resources beyond their initial access, possibly crossing tenant boundaries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

CVE-2026-33105

Affected Products

Azure Kubernetes Service

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-33105 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33105 · Vendor Advisory
• https://twitter.com/ptdbugs/status/2039873302584271091 · Twitter Post
• https://twitter.com/jlabernathy/status/2040081911649837553 · Twitter Post
• https://twitter.com/vitobotta/status/2040052051611164774 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039886413228085610 · Twitter Post
• https://twitter.com/integ_sec/status/2042592976757461297 · Twitter Post
• https://twitter.com/CVEarity/status/2039960208760541657 · Twitter Post
• https://twitter.com/CVEnew/status/2040128751946620949 · Twitter Post
• https://twitter.com/KwazaIct/status/2040541180790734884 · Twitter Post
• https://twitter.com/CveFindCom/status/2039866214810296687 · Twitter Post