intelligence_src_d11443da85ea659d49
- Source-provided label
- Publisher RSS metadata
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Oct 11, 2022 00:00 UTC
- Retrieved
- Oct 15, 2026 16:51 UTC
Azure Arc-enabled Kubernetes privilege escalation
Azure Arc allows customers to connect on-premises Kubernetes clusters to Azure. This is facilitated by middleware (the Azure Arc-enabled Kubernetes agent) which includes a "cluster connect" feature in the form of a reverse proxy. A vulnerability in this feature could allow an unauthenticated user to elevate their privileges and potentially gain remote administrative control over any Azure Arc-enabled cluster, as long as they know its randomly generated external DNS endpoint. Azure Stack Edge devices are also affected, because the service supports deployment of Kubernetes workloads via Azure Arc.
Reference details
- Source category
- research-report
- First reported
- Oct 11, 2022 00:00 UTC
- Last reported
- Oct 11, 2022 00:00 UTC
- Catalog updated
- Oct 15, 2026 16:51 UTC
- Record ID
b4e42feb95f75f87ed5c707fba2047767ef9199bf5c5f8a7c30ce83dc5c18c20
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Review source update dates and status
- intelligence_src_d11443da85ea659d49Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.