'Confused Deputy' Flaws Persist in Google Cloud, Microsoft Azure
Independent researcher Justin O'Leary has identified persistent 'Confused Deputy' vulnerabilities in Microsoft Azure and Google Cloud Platform, potentially allowing attackers elevated privileges.
Independent security researcher Justin O'Leary has highlighted persistent 'Confused Deputy' vulnerabilities affecting both Microsoft Azure and Google Cloud Platform (GCP). These flaws, if exploited, could allow attackers to gain elevated administrative privileges and bypass existing access controls within cloud environments, posing a significant risk to enterprise and government resources.
O'Leary's research, which he will present at Black Hat USA 2026, details how these vulnerabilities stem from fundamental weaknesses in how cloud platforms manage trust chains, rather than isolated bugs. The 'Confused Deputy' problem, first described by Norm Hardy in 1988, occurs when a system receives a request from an upstream entity but fails to properly verify the original source, allowing it to be forwarded to external parties with potentially malicious intent.
The first vulnerability O'Leary disclosed affects Microsoft's Azure Kubernetes Service (AKS) backup service. He found that an attacker with basic Backup Contributor privileges could exploit a confused deputy flaw to escalate their access to cluster-admin privileges within the AKS. This level of access would enable an attacker to exfiltrate sensitive data from backups or deploy malicious workloads to any cluster within the network.
The second vulnerability, disclosed on June 18, impacts Google Cloud Platform's Config Connector. This open-source add-on allows users to manage GCP resources via Kubernetes. O'Leary discovered that Config Connector does not perform adequate authorization checks against Google's Identity and Access Management (IAM) before processing requests. Consequently, an attacker with basic Kubernetes namespace access but no GCP permissions could use Config Connector to grant themselves GCP Organization Owner status, effectively gaining full administrative control.
A particularly concerning aspect of the GCP vulnerability is that an attacker's actions are logged as service account activity, masking the true source of the attack. "The attacker is essentially invisible" in the cloud audit logs, O'Leary stated, making detection extremely difficult.
O'Leary reported these issues to both Microsoft and Google, but encountered differing responses. Microsoft reportedly implemented a silent patch for the AKS vulnerability, which O'Leary views as an admission of the flaw, though it complicates tracking for customers. Google's Vulnerability Rewards Program initially seemed receptive but ultimately decided the Config Connector issue did not qualify for a bounty, despite O'Leary's assertion that the company's argument placed undue responsibility on customers for a flaw inherent in the tool's design.
O'Leary emphasizes that these 'Confused Deputy' issues are not unique to Azure and GCP, noting that similar connectors are used by other major cloud providers. He argues that the pervasive nature of these vulnerabilities is partly due to a 'cookie-cutter' approach in building large cloud infrastructures, leading to recurring fundamental weaknesses. Proper credential scoping and strict separation of trust boundaries are crucial mitigation strategies.
The persistence of 'Confused Deputy' flaws nearly 40 years after the concept was first identified underscores ongoing challenges in cloud security, particularly concerning managed identity trust chains and the need for rigorous validation of requests across different privilege levels.