Azure Kubernetes Configuration Service: missing authentication allows unauthorized attackers to elevate privileges over a network (CVE-2026-83938)
Severity: critical · Patch status: patched · Since 2026-10-22 · CVE-2026-83938
Microsoft published CVE-2026-83938 on 22 October 2026, a missing-authentication flaw in the Azure Kubernetes Configuration Service that let an unauthenticated attacker elevate privileges over the network. It affects tenants using AKS configuration features, where a rider on the service can reach things it should not. Microsoft reports no exploitation and no public disclosure, and the fix is applied to the Azure service rather than to a component you upgrade, so the work is verification: confirm the update reached your tenants and look for signs that someone used the gap.
What to do
- Confirm the October 2026 fix has reached your tenants via Azure Service Health rather than a patch calendar
- Review Azure Kubernetes Configuration Service access and audit logs for unauthorised privilege elevation
- Audit AKS cluster role bindings and node pool configuration for changes you cannot account for
- Restrict network exposure of AKS management and configuration endpoints to known administration ranges
Sources
All live incidents on Threat Watch
