VDB

GCVE-110-CLOUD-2022-0012

GCVE-110-CLOUD-2022-0012
Advisory Published
Vulnetix · Advisory published October 11, 2022
Azure Arc allows customers to connect on-premises Kubernetes clusters to Azure. This is facilitated by middleware (the Azure Arc-enabled Kubernetes agent) which includes a "cluster connect" feature in the form of a reverse proxy. A vulnerability in this feature could allow an unauthenticated user to elevate their privileges and potentially gain remote administrative control over any Azure Arc-enabled cluster, as long as they know its randomly generated external DNS endpoint. Azure Stack Edge devices are also affected, because the service supports deployment of Kubernetes workloads via Azure Arc.
Download JSON Open in Console

Affected Products

VendorProductVersionsPlatforms
AzureCloud Services——
AzureAzure Arc, Azure Stack Edge——

Aliases

CVE-2022-37968

References

Azure Arc-enabled Kubernetes privilege escalation
advisory
advisory
advisory
advisory

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›