'Confused Deputy' Flaws Persist in Google Cloud, Microsoft Azure

The report details two significant "confused deputy" vulnerabilities in major cloud platforms: an Azure AKS backup Trusted Access flaw that can escalate Backup Contributor privileges to cluster-admin, and a GCP Config Connector IAM bypass that can let a Kubernetes user obtain Organization Owner rights. The researcher disclosed both to Microsoft and Google; Microsoft appears to have silently patched its issue, while Google declined a bounty and did not classify the Config Connector behavior as a vulnerability despite the tool's wide deployment, including in FedRAMP-authorized environments.