CVE-2026-50173

The core vulnerability in CVE-2026-50173 is not a permission bypass — it's a mislabeled permission. The Azure credential provider treats the `InvokeNone` constant as a signal to generate write/delete SAS tokens (`sp=rwdl`), which directly contradicts what `InvokeNone` implies to every upstream caller. When the route layer sees `InvokeNone`, it believes it's granting zero content access. When the credential provider sees the same constant, it's minting the most permissive content tokens available. One of these contracts is wrong, and the naming suggests the Azure implementation diverged from its original design intent without updating the constant's semantics. This is an abandoned abstraction failure. The abstraction layer defined the `InvokeNone` enum constant but never specified what tokens it should or should not produce. Each credential provider implementer had to reverse-engineer the contract from usage patterns. The Azure provider chose to generate content SAS tokens — a blast radius maximizing decision that produces three reusable tokens (app content, user-content, and logs), each decoupling authorization from authentication and persisting until expiry. Unlike a transient access bug, these tokens remain functional even after permission revocation. The self-hosted Azure-only scope is analytically significant. The routing logic suggests the credential provider abstraction was designed for multiple backends, but only Azure has this flaw. Self-hosted Azure deployments represent the forgotten deployment profile — less tested than managed infrastructure, configuration-gated in ways that create untested code paths, and without the institutional memory that would catch semantic drift. For remediation: version 1.0.4 likely corrects the Azure provider's `InvokeNone` branch, but the incident should prompt two actions. First, audit every other credential provider (AWS S3, GCS) for equivalent `InvokeNone` handling inconsistencies — if this is Azure-specific, that's a different severity than if the pattern is systemic. Second, the permission model documentation must explicitly specify what `InvokeNone` must NOT produce; naming alone clearly isn't sufficient. Without documented behavioral contracts, the next backend addition will face the same ambiguity. Presigned credential issuance may need architectural reconsideration given that these artifacts inherently outlive any permission state.

Reviewed through automated stages and approved by a human before publication.