CVE-2026-88132: Azure Key Vault Information Disclosure Vulnerability
Azure Key Vault Information Disclosure Vulnerability
Other sources
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.10.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.9.2
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is exploitable over a network and does not require attacker privileges or user interaction. Exploitation is rated as high complexity.
What is the expected security impact if exploitation succeeds?
The stated impact is high confidentiality impact, meaning information may be disclosed. No integrity or availability impact is indicated.
Which Azure Key Vault client components are identified in the affected software list?
The listed components are azure-keyvault-keys, azure-keyvault-secrets, azure-keyvault-administration, azure-keyvault-certificates, and the Microsoft Azure Key Vault Client SDK. No affected version ranges are provided in the available data.