What is the CVSS score of CVE-2026-33105?

CVE-2026-33105 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Kubernetes are affected by CVE-2026-33105?

Microsoft Azure Kubernetes Service (AKS) contains a critical authorization bypass (CVE-2026-33105, CVSS 10.0) that allows unauthenticated remote attackers to gain administrative privileges over…. A patch is available.

How to fix or mitigate CVE-2026-33105?

Within 24 hours: Inventory all AKS deployments and their versions; implement network segmentation to restrict cluster API access to trusted sources only; enable Azure RBAC and Kubernetes RBAC enforcement if not already active. Within 7 days: Isolate non-critical AKS clusters from production networks; disable public cluster endpoints and enforce private cluster mode; audit all cluster access logs for unauthorized activity. Within 30 days: Monitor Microsoft security advisories for patch release; prepare isolated test environments for patch deployment; develop rollback procedures for emergency cluster updates.

Kubernetes CVE-2026-33105

EUVD-2026-18562 CRITICAL

Improper Authorization (CWE-285)

2026-04-03 secure@microsoft.com

GHSA-q5xq-rvph-wwgr

Authentication Bypass Kubernetes Microsoft Azure Kubernetes Service

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jul 24, 2026 - 21:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

EUVD ID Assigned

Apr 03, 2026 - 00:22 euvd

EUVD-2026-18562

Analysis Generated

Apr 03, 2026 - 00:22 vuln.today

CVE Published

Apr 03, 2026 - 00:16 nvd

CRITICAL 10.0

DescriptionNVD

Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Microsoft Azure Kubernetes Service (AKS) contains an improper authorization vulnerability enabling unauthenticated remote attackers to elevate privileges over a network with critical impact across confidentiality, integrity, and availability. The CVSS 10.0 critical rating reflects network-accessible exploitation requiring no authentication, low complexity, and scope change allowing compromise beyond the vulnerable component. No public exploit identified at time of analysis, though the authentication bypass nature and maximum severity warrant immediate priority.

Technical ContextAI

This vulnerability stems from CWE-285 (Improper Authorization), indicating a flaw in AKS's access control enforcement mechanisms that fails to properly validate user permissions before granting elevated privileges. Azure Kubernetes Service manages containerized applications through Kubernetes orchestration, where authorization typically flows through Kubernetes RBAC (Role-Based Access Control) and Azure Active Directory integration. The improper authorization allows bypass of these controls, potentially at the API server level, kubelet authentication layer, or Azure control plane interface. Given the Kubernetes multi-tenant architecture, authorization failures can expose cluster-wide resources, workloads, and underlying infrastructure across namespace boundaries.

RemediationAI

Organizations must immediately consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33105 for vendor-released patches and specific remediation guidance. Microsoft typically delivers AKS security updates through automatic control plane updates or requires manual cluster upgrades depending on severity and cluster configuration. Until patching is complete, implement compensating controls including restricting AKS API server network access through authorized IP ranges, enabling Azure Private Link for AKS to eliminate public internet exposure, enforcing Azure AD Pod Identity for workload authentication, and conducting immediate audit log review for unauthorized privilege escalation attempts. Monitor AKS audit logs for unusual authentication patterns, unauthorized role binding creation, and abnormal API server access from unexpected source IPs. Given the critical severity and authentication bypass nature, emergency patching outside normal maintenance windows is justified.