---
id: "CVE-2026-122986"
page: "https://infrastack.ai/live/CVE-2026-122986"
kind: "vulnerability"
aliases: ["CVE-2026-122986"]
title: "Azure Kubernetes Service: improper privilege management lets an authorized user gain higher privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aks", "azure", "azure-linux", "infrastructure", "kubernetes", "linux-kernel", "local-privilege-escalation"]
not_affected_if: []
published_at: "2026-11-10T19:20:38+00:00"
first_seen_at: "2026-11-10T19:25:11+00:00"
updated_at: "2026-11-10T21:35:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122986", "first_seen_at": "2026-11-10T19:25:11+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-122986", "first_seen_at": "2026-11-10T21:35:30+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-122986"]}]
exploit_sources: []
---

# Azure Kubernetes Service: improper privilege management lets an authorized user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-122986 (this .md is for agents)

Azure Kubernetes Service has an improper privilege management flaw that lets an attacker who already has authorized access elevate their privileges locally. The sources give a CVSS score of 7.8 and no further detail on the affected component or exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unconfirmed. Check the node kernel (kubectl get nodes -o wide, KERNEL-VERSION column) for an Azure Linux 3.0 kernel-mshv 6.6.x build, and read the MSRC entry for CVE-2026-122986 for the fixed build. The AKS security bulletin page did not list this CVE as of 2026-11-10.

## Timeline

- 2026-11-10T19:25:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122986
- 2026-11-10T21:35:30+00:00 analyst https://app.opencve.io/cve/CVE-2026-122986 — MSRC page is JS-only and returned nothing; the AKS security bulletin page has no entry for this CVE. Only the CNA record via OpenCVE was read: the affected product is an Azure Linux kernel-mshv package, with a confusing range (< 6.6.18.34.mshv3-2.azl3). No fix, exploitation or PoC confirmed. Nothing verified. Needs a revisit once MSRC or the AKS bulletin publishes the fixed node image.

## Documents

- [describes] OpenCVE: CVE-2026-122986 (mirrors CNA record) https://app.opencve.io/cve/CVE-2026-122986

## From the sources

Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_