Microsoft Azure Kubernetes Service Path Traversal Vulnerability Leading to Remote Code Execution

A path traversal vulnerability has been identified in Microsoft Azure Kubernetes Service (AKS), allowing an authorized attacker to execute code locally. This issue arises from improper restrictions on pathnames, enabling exploitation by breaking out of a container and gaining control of the AKS worker node.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the AKS worker node, allowing an attacker to gain control over the node.

Remediation

Users can download the security update for Azure Kubernetes Service from the Microsoft GitHub repository for Agent Baker, specifically version v0.20260213.5.