CVE-2026-69543

The CVSS 8.5 score and 'authorized attacker' qualifier in this CVE mask a critical cloud-native attack chain. SSRF here isn't a path to read arbitrary internal services—it's a pivot point to Azure's Instance Metadata Service (IMDS) at 169.254.169.254, where the vulnerability can extract control plane tokens from what should be a contained compute instance. An actor with local VM contributor access or limited Azure RBAC permissions on the VM resource can extract tokens that authorize subscription-level ARM operations, turning a single VM foothold into account-wide control. That's not horizontal movement; it's a vertical escalation from compute access to management plane authority. The 'authorized attacker' framing is doing dangerous analytical work. It treats authorization as a fixed property, but Azure's permission model is layered and frequently misconfigured in practice. A user with local VM contributor rights may not realize their RBAC assignment also grants IMDS access that exposes cross-subscription tokens. The cognitive gap between understanding Azure's RBAC roles, managed identity scopes, and NSG rules across control and data planes creates exactly the conditions where analysts miss these paths. What the CVE calls 'authorized' is often someone who already passed one security boundary and is now pivoting to a second—and the blast radius reflects that escalation, not containment. The deeper pattern is architectural, not coincidental. Azure documented a security boundary with IMDS v2, added token boundaries, and the platform is still leaking tokens through SSRF eight years later. The IMDS endpoint is a single choke point where compute access intersects with identity issuance—a design choice that concentrates blast radius in one service. Every time a new security layer gets added around IMDS, older assumptions about 'internal-only' access persist in older SDK versions, deprecated agent patterns, and configuration paths that never got migrated. This isn't just a tooling failure; it's sedimented architectural assumptions that newer controls don't fully cover. The critical open question the CVE doesn't answer: what minimum authorized position triggers this path? If it requires Azure RBAC on the VM resource itself, the blast radius is constrained to users who already have management plane access—but if it requires only local VM access, any compromised credential or insider threat can reach the control plane. That distinction changes the blast radius from narrow to enterprise-wide, and it makes the CVSS 8.5 look optimistic regardless of how you slice it. Remediation isn't just patching the SSRF—it's auditing which generation of Azure tooling is still operating under pre-cloud assumptions about what 'internal' means, and treating any IMDS-accessible workload as a control plane boundary regardless of the RBAC role assigned to it.

Reviewed through automated stages and approved by a human before publication.