CVE-2026-25219 Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

The accesskey and connectionstring connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure...

CVE-2026-25219: Exposure of Sensitive Information to an Unauthorized Actor

The accesskey and connectionstring connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure...

PT-2026-33058

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.1.8 Description The secrets masker failed to mark the access key and connection string connection properties as sensitive. This allows users with read permissions to view these values in the Connection UI...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in several Azure components. A malicious party could exploit these vulnerabilities by having multiple Azure and Microsoft components fail to validate input adequately or process untrusted data insecurely, allowing an authorized attacker to increase privileges...

EUVD-2026-22560

Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...

EUVD-2026-22573

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

EUVD-2026-22559

Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-32192

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-32171

Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...

CVE-2026-32168

Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

2026-04 Cumulative Update for Windows Server 2022 Datacenter: Azure Edition for x64-based Systems (KB5082142)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

CVE-2026-32171

Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...

CVE-2026-32171 Azure Logic Apps Elevation of Privilege Vulnerability

...

CVE-2026-32171

CVE-2026-32171—Azure Logic Apps Elevation of Privilege is confirmed with a high-severity impact (CVSS v3.1 base 8.8) due to insufficiently protected credentials that allow an authorized attacker to obtain elevated privileges over the network. Affected product: Azure Logic Apps. Root cause: insuff...

CVE-2026-32171 Azure Logic Apps Elevation of Privilege Vulnerability

...

CVE-2026-32192 Azure Monitor Agent Elevation of Privilege Vulnerability

...

CVE-2026-32192

Azure Monitor Agent is affected by a Deserialization of untrusted data vulnerability (CVE-2026-32192) that allows an authorized attacker to elevate privileges locally. Public sources describe the issue as an elevation of privilege in Azure Monitor Agent, linked to improper input validation during...

CVE-2026-32192

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-32192 Azure Monitor Agent Elevation of Privilege Vulnerability

...

CVE-2026-32168

CVE-2026-32168 concerns the Azure Monitor Agent. The connected sources confirm an elevated-privilege vulnerability caused by improper input validation, enabling an authorized attacker to obtain higher privileges locally. Affected components explicitly named include Azure Monitor Agent (and relate...