Loading vulnerability…
Authorization Bypass in Microsoft Container Registry
CVE-2026-69865 is a CWE-639 authorization-bypass vulnerability in the exclusively hosted Microsoft Container Registry service. The flaw arises from authorization decisions that use a user-controlled key, enabling an unauthenticated attacker to bypass intended repository access controls over the network and elevate privileges. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can grant an unauthorized attacker elevated privileges in Microsoft Container Registry, with high confidentiality and integrity impact. An attacker may access repositories and push malicious container images. No direct availability impact is identified.
If you can’t patch tonight, do this now.
Apply least-privilege repository and registry permissions, review container-image provenance and deployment trust controls, and investigate anomalous registry activity, API calls, repository access, image pushes, and role-assignment changes.
Patch, then assume compromise.
Microsoft Container Registry is a Microsoft-managed hosted service; customers cannot independently deploy a platform patch. Confirm that Microsoft has applied the security fix to affected tenancies through the Microsoft Security Response Center Update Guide and follow any service-specific remediation guidance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.