Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability
Priority MEDIUM 48Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.
Summary
Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.
Why it matters now
EPSS 0.02983 87th percentileScored 2026-11-07
Fix Fixed Azure Arc-enabled Kubernetes cluster 1.8.11 (Microsoft): 1.8.11Azure Arc-enabled Kubernetes cluster 1.7.18 (Microsoft): 1.7.18+3 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Azure Arc-enabled Kubernetes cluster 1.8.11 | 1.0.0 to before 1.8.11 | 1.8.11 | Patch available | CNA |
| Microsoft | Azure Arc-enabled Kubernetes cluster 1.7.18 | 1.0.0 to before 1.7.18 | 1.7.18 | Patch available | CNA |
| Microsoft | Azure Arc-enabled Kubernetes cluster 1.5.8 | 1.0.0 to before 1.5.8 | 1.5.8 | Patch available | CNA |
| Microsoft | Azure Arc-enabled Kubernetes cluster 1.6.19 | 1.0.0 to before 1.6.19 | 1.6.19 | Patch available | CNA |
| Microsoft | Azure Stack Edge | 2.2.0 to before 2.2.2088.5593 | 2.2.2088.5593 | Patch available | CNA |
- Azure Arc-enabled Kubernetes cluster 1.8.11 VendorMicrosoft Affected 1.0.0 to before 1.8.11 Fixed in 1.8.11 Patch available CNA
- Azure Arc-enabled Kubernetes cluster 1.7.18 VendorMicrosoft Affected 1.0.0 to before 1.7.18 Fixed in 1.7.18 Patch available CNA
- Azure Arc-enabled Kubernetes cluster 1.5.8 VendorMicrosoft Affected 1.0.0 to before 1.5.8 Fixed in 1.5.8 Patch available CNA
- Azure Arc-enabled Kubernetes cluster 1.6.19 VendorMicrosoft Affected 1.0.0 to before 1.6.19 Fixed in 1.6.19 Patch available CNA
- Azure Stack Edge VendorMicrosoft Affected 2.2.0 to before 2.2.2088.5593 Fixed in 2.2.2088.5593 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.5.8:*:*:*:*:*:*:* | 1.5.8 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.6.19:*:*:*:*:*:*:* | 1.6.19 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.7.18:*:*:*:*:*:*:* | 1.7.18 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.8.11:*:*:*:*:*:*:* | 1.8.11 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_stack_edge:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.5.8:*:*:*:*:*:*:* Versions 1.5.8 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.6.19:*:*:*:*:*:*:* Versions 1.6.19 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.7.18:*:*:*:*:*:*:* Versions 1.7.18 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.8.11:*:*:*:*:*:*:* Versions 1.8.11 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_stack_edge:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
Remediation
- Fix · CNA Azure Arc-enabled Kubernetes cluster 1.8.11 (Microsoft) Fixed in 1.8.11
- Fix · CNA Azure Arc-enabled Kubernetes cluster 1.7.18 (Microsoft) Fixed in 1.7.18
- Fix · CNA Azure Arc-enabled Kubernetes cluster 1.5.8 (Microsoft) Fixed in 1.5.8
- Fix · CNA Azure Arc-enabled Kubernetes cluster 1.6.19 (Microsoft) Fixed in 1.6.19
- Fix · CNA Azure Stack Edge (Microsoft) Fixed in 2.2.2088.5593
Vendor assessments
Microsoft
Microsoft's page for this CVE →
- Impact
- Elevation of Privilege
- Exploited
- No
- Publicly disclosed
- —
- Exploitability
- Exploitation Less Likely
| Product | Status | Plan or fix |
|---|---|---|
| Azure Arc-enabled Kubernetes cluster 1.5.8 | Fixed | 1.5.8 · Security Update |
| Azure Arc-enabled Kubernetes cluster 1.6.19 | Fixed | 1.6.19 · Security Update |
| Azure Arc-enabled Kubernetes cluster 1.7.18 | Fixed | 1.7.18 · Security Update |
| Azure Arc-enabled Kubernetes cluster 1.8.11 | Fixed | 1.8.11 · Security Update |
| Azure Stack Edge | Fixed | 2.2.2088.5593 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-37968
- 2026-10-03 Alias added: GHSA-9cqg-4xp4-h354
References
Sources
- CVE-2022-37968 · CVE Program
- CVE-2022-37968 · NVD
- FIRST EPSS
- GHSA-9cqg-4xp4-h354 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-37968 · Microsoft Security Update Guide
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences