Microsoft and HashiCorp Disclose Critical Kubernetes Security Flaws

Microsoft listed a missing authentication flaw in the Azure Kubernetes Configuration Service on October 22, 2026, according to shattered.io. The vulnerability is tracked as CVE-2026-83938 and received the maximum severity rating of 10.0 on the CVSS 3.1 scale. [1]

Four days after the Microsoft disclosure, HashiCorp published advisory HCSEC-2026-50, shattered.io reported. The advisory details a cross-namespace authorization bypass vulnerability in consul-k8s, which requires platform teams to update their software version and adjust configurations. [1]

The Common Vulnerability Scoring System provides a framework for assessing computer system vulnerabilities by calculating scores based on exploit ease and impact. Scores range from 0 for minor issues to 10 for severe risks. Base scores reflect constant qualities, while temporal and environmental metrics account for mitigations and vulnerable system deployment. [3]

In a separate security issue, The Hacker News reported a critical flaw in Canonical LXD and MicroCloud. The vulnerability allows an attacker reaching the network HTTPS API to log in as a trusted client without needing that client private key, provided the attacker possesses the client public certificate. [2]

Remediation requirements differ between the disclosed Kubernetes flaws, shattered.io reported. Because the Microsoft vulnerability sits within a hosted cloud service, the provider applies the fix directly, whereas the HashiCorp consul-k8s issue requires manual updates from self-managing deployment teams. [1]