Microsoft rejects critical Azure vulnerability report, no CVE issued

A security researcher reported a Confused Deputy privilege-escalation flaw in Azure Backup for AKS that allowed an attacker with only Backup Contributor role on a vault to trigger Trusted Access and gain Kubernetes cluster-admin privileges, enabling secret exfiltration or deployment of malicious workloads. CERT/CC validated the issue and assigned a tracking identifier, but Microsoft disputed the finding, recommended against CVE issuance, and—according to the researcher—appears to have silently changed behavior and added permission checks without issuing a public advisory, leaving defenders uncertain about exposure windows and remediation timelines.