Security researcher Justin O'Leary revealed two "confused deputy" vulnerabilities affecting both Microsoft Azure and Google Cloud Platform, a type of flaw that allows an attacker to escalate administrative privileges and bypass access controls of both clouds, according to a report by Dark Reading.
A "confused deputy" flaw occurs when a service receives a request from an external entity but does not preserve the legitimate origin of that request and ends up forwarding it to third parties as if it were its own, allowing an attacker to gain permissions they should never have received. In Azure, the flaw is located in the Kubernetes Service backup tool, capable of granting cluster administrator access. In Google Cloud, the issue is found in Config Connector, and allows a user to become the owner of the entire organization within the platform.
O'Leary reported both vulnerabilities directly to the cloud providers, but neither company formally acknowledged them nor paid a reward for their discovery, although Microsoft apparently fixed the Azure flaw without publicly announcing it. The researcher pointed out that these vulnerabilities illustrate a pattern of fundamental weaknesses in permission design of cloud platforms, rather than being isolated and specific errors.
The antecedent of this type of flaw dates back decades in the history of cybersecurity, when the "confused deputy" problem was first identified as a structural category of vulnerability in systems that delegate permissions between different components. Its persistence in modern cloud platforms, explicitly designed to manage identity and access at scale, confirms that this type of architectural error remains difficult to eliminate completely even for the largest providers on the market.
For technology companies in Latin America operating critical workloads on Azure or Google Cloud, this finding confirms the need to independently audit the permission configuration between services, rather than assuming that the cloud provider's security architecture completely eliminates this type of structural risk.
From the perspective of next+, the case confirms that even the largest cloud providers in the world are not exempt from fundamental design flaws in their permission systems, which forces organizations that rely on that infrastructure to maintain their own layer of access verification, rather than completely delegating that responsibility to the provider.