---
title: "'Confused Deputy' Vulnerabilities Found in Azure and Google Cloud"
description: Serious security flaws in Microsoft Azure and Google Cloud, and what they mean for Kubernetes access control.
canonical_url: https://codekeeper.co/ticker/azure-google-cloud-security-flaws-kubernetes
---

# 'Confused Deputy' Vulnerabilities Found in Azure and Google Cloud

Serious security flaws in Microsoft Azure and Google Cloud, and what they mean for Kubernetes access control.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jul 28, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Security researcher Justin O'Leary found serious "confused deputy" flaws in both Microsoft Azure and Google Cloud Platform — disclosing the Azure bug on 12 May and the GCP one on 18 June — and neither company properly acknowledged them. The Azure bug lets an attacker escalate from Backup Contributor, with zero Kubernetes permissions, to full cluster-admin access via the AKS backup service. O'Leary rates it CVSS 9.9. The GCP flaw sits in Config Connector, the open source Kubernetes add-on for managing GCP resources, and lets someone with basic namespace access silently crown themselves GCP Organization Owner — with the attack hidden from audit logs, since it looks like service account activity. Microsoft appears to have quietly patched its flaw without disclosure or a CVE. Google's bug bounty panel told O'Leary the report "didn't qualify," arguing customers are responsible for their own permission settings, though it said it might fix the issue anyway. Anyone running Config Connector should review who holds namespace access in the meantime. O'Leary details both at Black Hat USA 2026, in a talk called "Trust No Deputy: Breaking Azure and GCP Through Managed Identity Chains." Source: [Dark Reading](https://www.darkreading.com/cloud-security/confused-deputy-flaws-google-cloud-microsoft-azure)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fazure-google-cloud-security-flaws-kubernetes%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[PoC Claims Zero-Day Privilege Escalation in Kaspersky Endpoint Security Sep 1, 2026](https://codekeeper.co/ticker/kaspersky-zero-day-claim-windows11)

[Microsoft Links Mastra AI Supply Chain Attack to North Korean Hackers Aug 12, 2026](https://codekeeper.co/ticker/supply-chain-attack-on-mastra-by-sapphire-sleet)

[Software security Leader of 15 000-Mule Laundering Network Pleads Guilty Oct 13, 2026](https://codekeeper.co/ticker/oleg-korniev-guilty-money-laundering-ymco)

[Cyberattacks Clop Hackers Strike Again, Targeting PTC Software Used by Major Manufacturers Aug 20, 2026](https://codekeeper.co/ticker/clop-exploits-windchill-zero-day)