Azure Kubernetes Service CVE-2026-33105

Remote unauthenticated attacker against Azure Kubernetes Service (AKS) clusters with default RBAC configurations. No victim interaction required. Affects AKS clusters exposed to network access without additional authorization controls.

This represents an exceptionally high-priority vulnerability requiring urgent remediation. The CVSS 10.0 score is justified by the complete attack chain: network vector (AV:N) means internet-exposed AKS clusters are vulnerable, no authentication required (PR:N) eliminates access barriers, low complexity (AC:L) enables reliable exploitation, and changed scope (S:C) allows lateral movement beyond the initial target. While no public exploit code exists and CISA KEV status is not confirmed, the authentication bypass classification combined with maximum CVSS ratings indicates this vulnerability is highly automatable and likely to be rapidly weaponized once details emerge. The SSVC technical impact is total (confidentiality, integrity, and availability all rated High), making this exploitable against any organization running affected AKS versions. Unlike vulnerabilities with inflated CVSS but complex prerequisites, this authorization bypass presents genuine critical risk to cloud-native infrastructure.

An unauthenticated external attacker identifies an internet-accessible AKS cluster through reconnaissance of Azure IP ranges and standard Kubernetes API server ports. Exploiting the authorization bypass, the attacker sends specially crafted API requests to the AKS control plane that circumvent RBAC validation, gaining cluster-admin equivalent privileges without valid credentials. With elevated access, the attacker deploys malicious containers across all namespaces, exfiltrates secrets including database credentials and API keys, establishes persistence through modified DaemonSets, and potentially pivots to underlying Azure infrastructure through compromised pod identities, achieving complete cluster compromise within minutes of initial access.