CVE-2024-28917: Microsoft Azure Arc Extension Microsoft.azstackhci.operator

Medium severity, CVSS 6.2. EPSS: 0.9% chance of exploitation in the next 30 days.

Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability

Affected products

• Microsoft Azure Arc Extension Microsoft.azstackhci.operator: from 1.0.0, before 5.0.5 (fixed in 5.0.5)
• Microsoft Azure Arc Extension Microsoft.azure.hybridnetwork: from 1.0.0, before 1.0.2620-162 (fixed in 1.0.2620-162)
• Microsoft Azure Arc Extension Microsoft.azurekeyvaultsecretsprovider: from 1.0.0, before 1.5.2 (fixed in 1.5.2)
• Microsoft Azure Arc Extension Microsoft.iotoperations.mq: before 0.3.0-preview (fixed in 0.3.0-preview)
• Microsoft Azure Arc Extension Microsoft.networkfabricserviceextension: from 1.0.0, before 5.1.3 (fixed in 5.1.3)
• Microsoft Azure Arc Extension Microsoft.openservicemesh: from 1.0.0, before 1.2.6 (fixed in 1.2.6)
• Microsoft Azure Arc Extension Microsoft.videoindexer: from 1.0.0, before 1.1.2 (fixed in 1.1.2)

Published 2024-04-09. Last modified 2026-06-17.