'Confused Deputy' Flaws Persist in Google Cloud, Microsoft Azure
Two significant ‘confused deputy’ vulnerabilities persist in Google Cloud Platform (GCP) and Microsoft Azure, allowing attackers to escalate privileges and bypass security controls. Despite reporting these flaws to both companies, neither acknowledged them as vulnerabilities, and Microsoft silently patched its issue. These vulnerabilities stem from a fundamental design flaw in how managed identities and access controls are handled, leading to potential data exfiltration and deployment of malicious workloads. The issue is widespread, impacting numerous enterprises and government agencies, and highlights a systemic problem with identity and access management in cloud environments.
Two critical vulnerabilities, dubbed ‘confused deputy’ flaws, continue to plague Google Cloud Platform (GCP) and Microsoft Azure, posing a significant risk to enterprise and government environments. According to independent security researcher Justin O’Leary, these flaws allow attackers to bypass security controls and escalate privileges, potentially leading to data exfiltration and malicious workload deployment.
O’Leary discovered the first vulnerability in Microsoft Azure’s Kubernetes Service (AKS) backup service. The service uses Trusted Access, which grants the backup vault access to the AKS cluster through specific, assigned permissions. However, an attacker can exploit this to escalate privileges from a basic Backup Contributor level – with no Kubernetes permissions – to achieve cluster-admin privileges, enabling them to exfiltrate sensitive data or deploy malicious workloads.
O’Leary also identified a vulnerability in Google’s Config Connector, an open-source add-on for managing Google Cloud resources via Kubernetes. Config Connector doesn’t perform authorization checks to verify the user’s identity against Google’s IAM, bypassing the platform’s access controls. This allows a threat actor with basic Kubernetes namespace access and no GCP permissions to quickly establish themselves as a GCP Organization Owner, gaining full administrative control. Crucially, these actions are logged as service account activity, effectively concealing the attacker’s presence in cloud audit logs.
Despite reporting these flaws to Microsoft and Google, both companies initially declined to recognize them as vulnerabilities. Microsoft reportedly implemented a silent patch for the Azure flaw, while Google initially responded positively but ultimately determined the issue didn’t qualify for a bug bounty. Google argued that customers are responsible for setting appropriate permissions, but O’Leary contends that the connector’s design flaw – failing to verify user authorization – means Google has no means of preventing abuse.
Config Connector is deployed across numerous large enterprises and FedRAMP-authorized GCP environments, amplifying the potential impact. O’Leary suggests that credential scoping and trust boundary separations can mitigate these risks within customer cloud environments. He will detail these issues and potential solutions at Black Hat USA 2026, a cybersecurity event taking place from August 1 to August 6 at the Mandalay Bay Convention Center in Las Vegas.