Microsoft Azure Kubernetes Service contains an authorization flaw that lets an unauthenticated or low-privileged attacker increase their access rights within the cluster. This improper authorization can enable the attacker to perform higher-level actions, compromise cluster resources, and potentially expose sensitive data, as the failure involves both authentication weaknesses and privilege escalation mechanisms.

Microsoft Azure Kubernetes Service instances are affected. Specific versions are not listed in the advisory, so all current deployments with the identified flaw should be considered vulnerable until a patch is applied.

The vulnerability receives a CVSS score of 10, indicating critical severity. The EPSS score is under 1%, suggesting a low likelihood of widespread exploitation at present, and it has not been recorded in the CISA KEV catalog. Based on the description, the likely attack vector requires network access to the AKS API or cluster control plane; the flaw relies on improper authorization checks within that network context.