Azure Keyvault Securitydomain
Monthly
Weak authentication handling in Microsoft's Azure Key Vault integration libraries allows unauthenticated remote attackers to bypass a security feature, with high confidentiality and integrity impact but no availability impact. The exposure is limited to applications and services that depend on specific vulnerable client SDK versions - the Python packages azure-keyvault-administration (<4.7.1), azure-keyvault-securitydomain (<1.0.0b3), and azure-keyvault-certificates/secrets/keys (<4.11.2), plus the .NET packages Azure.Security.KeyVault.Certificates/Secrets/Keys (<1.0.1); deployments already on patched versions are not exposed. Although the CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates no authentication or user interaction is required, the High Attack Complexity reflects a meaningful non-trivial precondition - a timing or race window, a specific configuration, or an intermediary network position - rather than a single-request exploit of a default setup; no public exploit code has been identified at time of analysis, and this is a moderate-priority issue rather than an urgent fire drill.
Weak authentication handling in Microsoft's Azure Key Vault integration libraries allows unauthenticated remote attackers to bypass a security feature, with high confidentiality and integrity impact but no availability impact. The exposure is limited to applications and services that depend on specific vulnerable client SDK versions - the Python packages azure-keyvault-administration (<4.7.1), azure-keyvault-securitydomain (<1.0.0b3), and azure-keyvault-certificates/secrets/keys (<4.11.2), plus the .NET packages Azure.Security.KeyVault.Certificates/Secrets/Keys (<1.0.1); deployments already on patched versions are not exposed. Although the CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates no authentication or user interaction is required, the High Attack Complexity reflects a meaningful non-trivial precondition - a timing or race window, a specific configuration, or an intermediary network position - rather than a single-request exploit of a default setup; no public exploit code has been identified at time of analysis, and this is a moderate-priority issue rather than an urgent fire drill.