Independent researcher Justin O'Leary uncovered two confused deputy flaws in Google Cloud Platform and Microsoft Azure, allowing attackers to gain admin privileges and bypass cloud access controls. While Azure silently patched the issue, Google declined a bounty and left the vulnerability unaddressed.

Key Takeaways

  • Two confused deputy bugs found in Azure AKS backup and GCP Config Connector.
  • Exploitation grants admin rights without appearing in audit logs.
  • Microsoft applied a silent patch; Google refused a bounty and left the flaw open.

What the Flaws Entail

Confused deputy issues arise when a service forwards a request without preserving its original source, allowing a high‑privilege entity to be tricked into executing actions on behalf of an attacker. This bypasses firewalls and other access controls.

Historical Background

The term was coined by computer scientist Norm Hardy in a 1988 paper after discovering a similar vulnerability in the compiler of Tymshare, a commercial time‑sharing firm. Nearly four decades later, despite advances in Identity & Access Management (IAM), these flaws still surface in modern cloud architectures.

Specific Bugs in Azure and GCP

The first bug affects Azure Kubernetes Service (AKS) backup’s Trusted Access feature, letting an attacker elevate from a basic Backup Contributor to full cluster‑admin privileges. The second bug involves GCP’s Config Connector, which skips IAM verification, enabling a user with minimal Kubernetes namespace access to become a GCP Organization Owner.

Why This Matters

BozokMedia analysis shows that such systemic flaws undermine trust in managed‑identity chains, exposing enterprises and governments to silent, high‑impact breaches.

“If cloud providers don’t redesign their trust models, confused deputy bugs will persist well into the next decade.” – Justin O'Leary

Comparison Table

PlatformVulnerabilityPotential Impact
Azure AKS BackupTrusted Access flawCluster‑admin rights, data exfiltration
GCP Config ConnectorIAM bypassOrganization‑owner rights, invisible in logs
Did You Know?: The “confused deputy” concept is still a core case study in cybersecurity curricula worldwide.

Frequently Asked Questions

Have these bugs been fully patched? Azure applied a silent patch; Google has not yet released an official fix.

Do these vulnerabilities affect all users? Not every user, but any attacker with basic namespace access can leverage them to gain full administrative control.