CVE-2026-32193: Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability

Synopsis

A path traversal vulnerability in Microsoft Azure Kubernetes Service (AKS) allows a locally authenticated attacker to execute arbitrary code on the host. The attacker must already have a low-privilege account or process on the affected system; no network access is required. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected scope, including resources outside the immediate container boundary due to the changed scope. A patched-image rebuild at v0.20260213.5 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-based vector is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or elevated credentials.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker can trigger the exploit entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental prerequisites beyond local access.

Blast Radius

• Reads arbitrary files outside the intended directory boundary, including secrets, service account tokens, and configuration data on the host.
• Writes or overwrites files outside the restricted path, enabling injection of malicious content into privileged locations.
• Crashes or destabilizes the affected service and dependent workloads, causing service disruption across the node.
• Because the scope is changed (S:C), impact can extend beyond the originating container or process to other resources on the same node or cluster.