Significant cracks in the managed identity trust chains of the world’s biggest cloud platforms could put enterprise and government resources at risk.
That’s according to Justin O’Leary, independent security researcher, who discovered two “confused deputy” vulnerabilities in both Microsoft Azure and the Google Cloud Platform (GCP) earlier this year. Despite reporting them to the cloud giants, neither company acknowledged the vulnerabilities or paid a bug-bounty reward, even though Microsoft appears to have silently patched its flaw.
Confused deputy issues arise when a product or service receives a request from an upstream entity but fails to preserve the original source of request and even allows it to be forwarded to external parties. A threat actor can trick a high-privileged entity into accepting the request, which appears as if it’s coming from the original product or service and allows the attacker to bypass access controls such as firewalls.
Computer scientist Norm Hardy first coined the term in a 1988 paper after discovering a vulnerability more than a decade earlier in the compiler program at Tymshare, a commercial time-sharing firm in Silicon Valley. Despite the enormous advancements in IT, most notably in identity and access management (IAM), confused deputy flaws still persist today, nearly 40 years after Hardy’s paper.
This, O’Leary tells Dark Reading, is because many companies have gotten into some bad habits. “My feeling is that this problem is still around, because when you’re building these big cloud infrastructures, you’re often doing it in a cookie-cutter approach,” he says.
Big Confused Deputy Flaws in Azure, GCP
O’Leary says the vulnerabilities illustrate a pattern of fundamental weaknesses rather than just a series of isolated bugs. In an on-demand session at Black Hat USA 2026 next week, “Trust No Deputy: Breaking Azure and GCP Through Managed Identity Chains,” he will detail how the issue, tracked as CWE-114 under Mitre’s Common Weakness Enumeration, has become a pervasive problem for modern cloud architectures.
The first flaw, which O’Leary disclosed on May 12, involves Microsoft’s Azure Kubernetes Service (AKS) backup service. The service uses a feature called Trusted Access to give the backup vault access to the AKS cluster through specific, assigned permissions.
However, O’Leary found that an attacker can exploit a confused deputy flaw to escalate privileges from a basic Backup Contributor level, which has no Kubernetes permissions at all, to achieve cluster-admin privileges for the AKS. With such access, the attacker can exfiltrate sensitive data from backups or deploy malicious workloads to any cluster in the network.
O’Leary disclosed a second confused deputy flaw on June 18, this time an IAM bypass in GCP. The issue involves Config Connector, an open source add-on that lets users manage their Google cloud resources via Kubernetes. According to O’Leary’s research, Config Connector doesn’t perform authorization checks to confirm the user’s identity against Google’s IAM, bypassing the platform’s access controls.
“When a Kubernetes user submits an IAMPolicyMember referencing an external organization, Config Connector should verify: does this user have permission to grant IAM roles on this organization?” he wrote in a blog post. “It doesn’t. It passes the user-supplied organization ID directly to the GCP API using its own elevated credentials.”
As a result, a threat actor equipped with basic Kubernetes namespace access and no GCP permissions can use Config Connector to quickly establish themself as GCP Organization Owner with full administrative control. Additionally, the threat actor’s actions are logged as service account activity, which disguises the attack.
“The worst part, the part that people should be worried about, is you actually don’t see the attacker in the cloud audit logs,” he says. “The attacker is essentially invisible.”
Disclosure Discord for Confused Deputy Flaws
After discovering the bugs and reporting them to Microsoft and Google, O’Leary ultimately found himself in frustrating situations where both companies ultimately declined to recognize the issues as vulnerabilities that required fixing, he tells Dark Reading.
In the case of the Azure flaw, O’Leary discovered that after communicating with Microsoft and CERT/CC, the software giant had apparently closed the attack vector with a silent patch.
“A silent patch is an admission,” O’Leary explains, adding that such practices only protect vendors while making it hard for customers to track exposures and threats.
In Google’s case, the researcher initially got a positive response from the company and was in line for a bug-bounty reward. But the good vibes didn’t last long, as a Google Vulnerability Rewards Program (VRP) panel ultimately decided it wasn’t a vulnerability.
“They said they might fix it, but that it didn’t qualify for a bounty,” O’Leary says. “The contradictions were wild.”
Google appeared to argue that customers are responsible for setting the appropriate permissions of Config Connector, but O’Leary says this misses the point — the connector doesn’t verify if the user is authorized to request those permissions on a specific target, and Google has no means of preventing the abuse.
O’Leary notes that Config Connector is deployed across many large enterprises and government agencies, including FedRAMP-authorized GCP environments, and that Google’s documentation for the tool doesn’t properly communicate the risks of a confused deputy attack.
Google and Microsoft are hardly alone when it comes to confused deputy issues, O’Leary says, adding that these kinds of connectors used by other major cloud providers. He adds that credential scoping and trust boundary separations can help reduce confused deputy risks within customers’ cloud environments.
“I think it’s a systemic problem,” he says.
