Improper limitation of a pathname to a restricted directory

CVE-2026-32193 is a path-traversal flaw in Azure Kubernetes Service that lets an attacker who can deploy a pod with hostNetwork: true send crafted requests to a host-level service not meant for unauthenticated access. The traversal breaks out of the container's filesystem namespace and gives the attacker control of the AKS worker node. Affected versions are all AKS node images prior to v0.20260213.5, patched in the June 2026 Patch Tuesday cycle.

Microsoft scored this 8.8 HIGH with a Scope-change flag (S:C), which is technically accurate — the bug does cross the container-to-host boundary, and C/I/A are all total on the node. However, the vendor score does not sufficiently penalize the prerequisites: you must already hold credentials that let you schedule pods in the cluster, *and* the pod must be configured with hostNetwork: true, a setting that security-hardened clusters block via Pod Security Admission or Azure Policy. The real-world population of clusters where an attacker can both deploy arbitrary pods and enable hostNetwork is meaningfully smaller than the raw CVSS implies, so the 8.8 overstates the average enterprise exposure by about a point.

Why this verdict

• Prerequisites compound: The attacker must already hold cluster credentials AND be able to schedule hostNetwork pods. Each prerequisite assumes a prior compromise stage (stolen creds or over-permissioned RBAC), narrowing the realistic attacker population.
• No public PoC or exploitation: Two months post-disclosure, no exploit code or in-the-wild activity has surfaced. EPSS at 0.34% reinforces low near-term weaponization risk.
• Role multiplier: AKS is canonically a high-value orchestration component. Container escape on a worker node gives access to all co-located pod secrets, the kubelet client certificate, and cloud provider IMDS tokens. In multi-tenant clusters the blast radius is cross-tenant. This floors the verdict at HIGH despite significant friction.
• Default AKS permits hostNetwork: While security-hardened clusters block hostNetwork via PSA Baseline or Azure Policy, the default AKS configuration does not enforce these restrictions, meaning a non-trivial fraction (estimated >50%) of production clusters are reachable if the attacker has pod-creation RBAC.
• Auto-upgrade mitigates silently: AKS clusters on the node-image or rapid auto-upgrade channel received the fix automatically in June 2026, reducing the vulnerable population over time without admin action.

Why not higher?

CRITICAL would require either active exploitation, a public PoC lowering the barrier, or an unauthenticated remote attack path. This CVE requires authenticated cluster access plus hostNetwork pod creation — two prerequisites that each assume prior compromise. The blast radius is node-scale (not fleet-scale or control-plane-scale in managed AKS), and no attacker tooling exists to weaponize it.

Why not lower?

MEDIUM would undercount the blast radius of a container escape in a Kubernetes orchestration platform. Even with friction, a successful exploit yields root on the node, access to all co-located secrets, and potential lateral movement across the cluster. AKS is a canonical high-value-role component and the default configuration does not block the prerequisite hostNetwork setting, so the floor is HIGH.

1. Enforce Pod Security Admission at Baseline or Restricted level — The Baseline PSA profile blocks hostNetwork: true pods cluster-wide. Apply this to all non-system namespaces immediately. This completely eliminates the attack path. Per the noisgate mitigation SLA for HIGH, deploy within 30 days.
2. Enable Azure Policy for AKS to block hostNetwork pods — Apply the built-in Azure Policy Kubernetes cluster pods should only use approved host network and port range in Deny mode. This provides a backstop even if PSA is misconfigured. Deploy within 30 days per noisgate mitigation SLA.
3. Upgrade AKS node images to v0.20260213.5 or later — Trigger a manual node image upgrade via az aks nodepool upgrade --node-image-only if your cluster is not on an auto-upgrade channel. Verify current node image version in the Azure portal or via az aks nodepool show. This is the definitive remediation.
4. Enable Microsoft Defender for Containers — Provides runtime detection of container escape attempts, anomalous host-level process execution, and suspicious pod configurations. Acts as a detection-in-depth layer.
5. Restrict RBAC pod-creation permissions — Audit ClusterRoleBindings and RoleBindings. Ensure only CI/CD service accounts and platform teams can create pods. Revoke broad create pods permissions from developer identities.

Run this script from any workstation with az CLI and kubectl configured for the target AKS cluster. Requires az aks read permissions and a valid kubeconfig. Example: bash check_cve_2026_32193.sh my-resource-group my-aks-cluster

#!/usr/bin/env bash
# check_cve_2026_32193.sh — CVE-2026-32193 AKS node image version check
# Usage: bash check_cve_2026_32193.sh <resource-group> <cluster-name>
# Requires: az CLI authenticated, read access to AKS cluster
# Output: VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

RG="${1:-}"
CLUSTER="${2:-}"
FIXED_IMAGE="0.20260213.5"

if [[ -z "$RG" || -z "$CLUSTER" ]]; then
  echo "Usage: $0 <resource-group> <cluster-name>"
  exit 2
fi

echo "[*] Checking AKS node pools for cluster '$CLUSTER' in resource group '$RG'..."

VULNERABLE=0
PATCHED=0
UNKNOWN=0

while IFS= read -r line; do
  POOL_NAME=$(echo "$line" | cut -f1)
  NODE_IMAGE=$(echo "$line" | cut -f2)
  
  # Extract version number from node image string (e.g., AKSUbuntu-2204gen2containerd-v0.20260213.5)
  VERSION=$(echo "$NODE_IMAGE" | grep -oP 'v\K[0-9.]+' || echo "")
  
  if [[ -z "$VERSION" ]]; then
    echo "[?] Pool '$POOL_NAME': image '$NODE_IMAGE' — could not parse version"
    UNKNOWN=$((UNKNOWN + 1))
    continue
  fi
  
  # Compare versions using sort -V
  HIGHER=$(printf '%s\n%s\n' "$FIXED_IMAGE" "$VERSION" | sort -V | tail -1)
  
  if [[ "$VERSION" == "$FIXED_IMAGE" || "$HIGHER" == "$VERSION" ]]; then
    echo "[+] Pool '$POOL_NAME': image version $VERSION >= $FIXED_IMAGE — PATCHED"
    PATCHED=$((PATCHED + 1))
  else
    echo "[-] Pool '$POOL_NAME': image version $VERSION < $FIXED_IMAGE — VULNERABLE"
    VULNERABLE=$((VULNERABLE + 1))
  fi
done < <(az aks nodepool list --resource-group "$RG" --cluster-name "$CLUSTER" --query "[].{name:name, nodeImageVersion:nodeImageVersion}" -o tsv 2>/dev/null)

echo ""
if [[ $VULNERABLE -gt 0 ]]; then
  echo "VULNERABLE — $VULNERABLE node pool(s) running unpatched images"
  exit 1
elif [[ $PATCHED -gt 0 && $UNKNOWN -eq 0 ]]; then
  echo "PATCHED — all $PATCHED node pool(s) at or above fixed version $FIXED_IMAGE"
  exit 0
else
  echo "UNKNOWN — could not determine patch status for all pools (patched=$PATCHED, unknown=$UNKNOWN)"
  exit 2
fi

Sources

1. MSRC Advisory — CVE-2026-32193
2. NVD — CVE-2026-32193
3. CVE Record — CVE-2026-32193
4. Cisco Talos — Microsoft Patch Tuesday June 2026
5. CrowdStrike — Patch Tuesday Analysis June 2026
6. Microsoft Learn — Pod Security Admission in AKS
7. Microsoft Learn — AKS Vulnerability Management
8. Rapid7 — Patch Tuesday June 2026