Escalating privileges to read secrets with Azure Key Vault access policies

Datadog describes a privilege-escalation path in Azure Key Vault: when a vault uses access policies, a user with the Key Vault Contributor role (or Microsoft.KeyVault/vaults/write) can modify access policies to grant themselves data-plane access and read all secrets, keys, and certificates. Microsoft classified this as “not a vulnerability” and updated documentation to warn customers, recommending the RBAC permissions model, auditing and limiting roles with vaults/write, reviewing/removing unauthorized access policies, and rotating potentially exposed secrets.