Which versions of Container Migration Accelerator are affected by CVE-2026-73298?

Microsoft Container Migration Solution Accelerator versions 2.1.2 and earlier enables authenticated users to view, modify, or delete migration processes and files belonging to colleagues within the…

How to fix or mitigate CVE-2026-73298?

Within 24 hours, inventory all instances of Microsoft Container Migration Solution Accelerator and identify those running version 2.1.2 or earlier with multiple authenticated users; document the volume and criticality of migration data and process configurations under management. Within 7 days, implement restrictive role-based access control through Entra ID to segment teams and limit which users can access each instance, enable detailed audit logging on all file and process management API endpoints, and establish daily monitoring for cross-user resource access attempts. Within 30 days, conduct a complete access audit to identify any prior unauthorized modifications or deletions of migration resources, evaluate isolation options such as restricting instances to administrative-only access or dedicated single-user deployments, and establish a change control process to deploy vendor patches immediately upon release.

Container Migration Accelerator CVE-2026-73298

Q: What is the CVSS score of CVE-2026-73298?

CVE-2026-73298 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-57371 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-12 GitHub_M

Authentication Bypass Kubernetes Microsoft Container Migration Solution Accelerator

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable API, low complexity, authenticated low-privilege access required, no scope change; full C/I/A impact on the application's migration data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:36 vuln.today

CVE Published

Aug 12, 2026 - 17:24 cve.org

HIGH 8.7

DescriptionCVE.org

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the Container Migration Solution Accelerator, specifically an authenticated IDOR (Insecure Direct Object Reference) that allows users to read, write, and delete processes belonging to other authenticated users. The issue affects multiple API endpoints, where ownership checks are missing, enabling unauthorized access and modification of migration data across users within the same organization. The vulnerability is present in both process and file management APIs, and the application relies on Entra ID authentication but lacks proper authorization controls between users. Authenticated users are able to access, modify, and delete processes and files belonging to other users without proper authorization checks.

Articles & Coverage 1

News 3 New Kubernetes Vulnerabilities - 1 Critical, 2 High Severity Aug 13, 2026

AnalysisAI

Insecure Direct Object Reference in Microsoft Container Migration Solution Accelerator version 2.1.2 and earlier enables any authenticated organization member to read, overwrite, and delete migration processes and files belonging to other users within the same tenant. The application delegates identity verification to Entra ID but implements no per-resource ownership checks across its process and file management API endpoints, meaning the authentication boundary is entirely decoupled from the authorization boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full confidentiality, integrity, and availability impact on application data make this a high-priority remediation target for any multi-user deployment.

Technical ContextAI

The Container Migration Solution Accelerator (CPE: cpe:2.3:a:microsoft:container-migration-solution-accelerator:*:*:*:*:*:*:*:*) is a multi-agent, AI-driven application that orchestrates the migration of container service configurations to Azure Kubernetes Service. It relies on Microsoft Entra ID for user authentication but manages its own data model for migration processes and associated files independently of that identity layer. The root cause maps directly to CWE-639 (Authorization Through User-Controlled Key): the application's API endpoints accept user-supplied object identifiers - process IDs and file references - and retrieve or manipulate the corresponding resources without verifying that the requesting principal owns or is entitled to access them. This class of flaw arises when authentication is mistakenly treated as sufficient for authorization. Once Entra ID confirms a caller is a legitimate tenant member, the application performs no secondary ownership or permission check, allowing any low-privileged authenticated user to interact with any peer's data by supplying the appropriate identifier.

RemediationAI

The primary fix is to upgrade the Container Migration Solution Accelerator to a version that resolves the missing ownership checks, as described in the vendor's GitHub Security Advisory at https://github.com/microsoft/Container-Migration-Solution-Accelerator/security/advisories/GHSA-27mc-pccp-3x2x. No specific patched release version number is stated in the available input data; the advisory must be consulted directly to confirm the minimum safe version before upgrading. If an immediate upgrade is not feasible, the most actionable compensating control is to restrict access to the application to the smallest possible set of authenticated users - ideally assigning individual user accounts to isolated workspaces or separate application instances where multi-user co-tenancy is avoidable - to reduce the practical blast radius of cross-user access. Enabling comprehensive audit logging on all API calls to process and file management endpoints is a secondary control that supports detection of anomalous cross-user ID access patterns, though it does not prevent the unauthorized access itself. Note that API gateway authentication enforcement will not mitigate this issue because the flaw is an application-layer authorization gap, not a transport- or identity-verification gap.