Red Hat disclosed a critical flaw in its Advanced Cluster Management for Kubernetes that lets a user with only namespace-level edit rights escalate to full cluster administrator. Tracked as CVE-2026-10090 and scored 9.9, the bug is in the application subscription controller: a low-privileged user can create a channel pointing to a Helm repository they control, then a subscription referencing it, and the controller deploys the chart using its own elevated permissions without checking the requester's authorization. It is a confused-deputy problem that crosses the namespace-to-cluster boundary. Because namespace edit access is often granted broadly to developers, many multi-tenant clusters could be exposed, and no fix was available at disclosure.
Pillar Security showed that Google's Agent Development Kit repository could be turned against itself through a poisoned pull request or issue. The public repository ran a low-privileged triage agent that responded to outside contributions, and a higher-privileged agent reserved for maintainers. Because the triage agent posted through a bot account that counted as a repository collaborator, a prompt injection could make it post a command that satisfied the privileged workflow's trust check, invoking the maintainer-level agent. That crossed into a job holding a long-lived access token, a Google API key, and a cloud service-account credential, enabling code execution on the runner and secret theft. Google deleted the affected workflows.
Researchers showed that confused deputy weaknesses persist in Google Cloud and Microsoft Azure, where a trusted service can be tricked into acting on an attacker's behalf against resources it should not reach. The pattern shows up when one service holds broad permissions and accepts instructions or identifiers from a less-trusted source without verifying who is really asking, which can enable cross-tenant access or privilege escalation. It is the same class of issue behind recent findings in enterprise agent and integration tooling, where a component with a user's permissions follows attacker-supplied input. The takeaway is architectural: identity and authorization must be checked at every trust boundary, not assumed from the calling service.
Offensive security firm Manifold Security detailed a confused deputy flaw in Microsoft's official Azure DevOps MCP server, which lets AI agents read and operate Azure DevOps on a user's behalf across pull requests, pipelines, wikis, and work items, using that user's own permissions. One of the server's tools returns pull request descriptions without the prompt injection guardrail Microsoft had already applied to other tools. Because descriptions accept Markdown, an attacker can bury instructions in an HTML comment: the web interface renders it as nothing, so a reviewer sees an ordinary change, while the REST API returns the text verbatim and hands it straight to the agent.
TrustStrike Labs