This vulnerability arises from a missing authentication check on a critical function within the Azure Kubernetes Configuration Service, enabling an unauthenticated attacker to gain privileged control over the service. The compromised endpoint allows the attacker to execute actions beyond the scope of a standard user, potentially altering configurations, accessing sensitive cluster data, and escalating privileges to achieve full control of the Kubernetes environment.

Microsoft Azure Kubernetes Configuration Service. Versioning details are not provided, so all released versions should be treated as potentially vulnerable until an official fix is deployed.

The CVSS score of 10 underscores a critical impact if exploited. The EPSS score is not available, so the likelihood of exploitation in the wild cannot be precisely quantified, but the absence of a KEV listing indicates no publicly known exploits yet. Based on the described missing authentication, the likely attack vector is network‑based, where an attacker sends unauthenticated requests to privileged endpoints to elevate privileges within the service.