Microsoft’s February 2026 security updates closed a sensitive gap in Azure’s Confidential Container offering after the vendor recorded an information‑disclosure flaw that could expose secret tokens and cryptographic keys used by Azure Container Instances (ACI) Confidential Containers. The advisory that accompanied the Patch Tuesday release identifies the issue as an ACI Confidential Containers
information disclosure vulnerability — widely tracked as CVE‑2026‑23655 — and places it alongside a related elevation‑of‑privilege problem (CVE‑2026‑21522) that together underscore systemic risks for confidential computing in multi‑tenant cloud environments.
Background
Confidential Containers aim to give cloud customers hardware‑backed isolation for containerized workloads by combining container runtimes with Trusted Execution Environments (TEEs) such as AMD SEV‑SNP. In Azure, Confidential Containers are available through Azure Container Instances (ACI) and can be used in conjunction with AKS or as a lift‑and‑shift PaaS experience; they are explicitly designed to protect runtime data and code from cloud host operators and other tenants. That strong security guarantee depends on correct handling of secrets, attestation, and runtime memory protection.
In February 2026 Microsoft published updates that fixed multiple ACI Confidential Containers issues, including an
information disclosure vulnerability that was assessed as capable of exposing secret tokens and keys if an attacker could reach the affected surface. Security vendors and vulnerability databases catalogued the fix under CVE‑2026‑23655 and assigned it a mid‑high severity (CVSS ~6.5), while separate ACI issues — notably CVE‑2026‑21522 — covered command‑injection or elevation‑of‑privilege risks affecting the same feature set.
Important note on identifiers: the CVE identifier you provided in the prompt (CVE‑2026‑26122) does not match public advisories for ACI Confidential Containers; Microsoft and multiple third‑party trackers list the ACI information‑disclosure issue as CVE‑2026‑23655. I cross‑checked vendor advisories, major security venalyses, and NVD listings to reconcile the discrepancy and will use the vendor‑published ID and records for technical accuracy. (
msrc.microsoft.com)
What the vulnerability is (technical summary)
At a high level, CVE‑2026‑23655 is a
cleartext storage / information‑disclosure problem in the Azure Compute components that support ACI Confidential Containers. The vulnerability arises when sensitive artifacts —
tokens, keys and secret material — are either stored or cached in a form that is not adequately protected, allowing an attacker with
authorized access and network connectivity to retrieve the material over the network or from the runtime environment. Security analysts describe the underlying class as CWE‑312 (Cleartext Storage of Sensitive Information).
Key technical points confirmed by vendor and third‑party sources:
- The affected surface is Microsoft ACI Confidential Containers (the Azure Compute Gallery and supporting infrastructure that orchestrates confidential workloads).
- The vulnerability enables disclosure of secret tokens and cryptographic keys that, if harvested, can be abused for lateral movement or privilege escalation across tenant resources.
- The vulnerability does not, on its own, automatically grant remote code execution; rather, it exposes material that — in the hands of an attacker — can be used to escalate into other actions. That said, token theft in cloud environments frequently converts a low‑level local problem into an immediate tenant comp
Where sources differ or remain silent:
- Microsoft’s MSRC advisory pages act as the vendor‑of‑record but are delivered through an interactive UI that sometimes obscures long text payloads for automated scraping; third‑party vendors and NVD provide the complementary technical summaries used by defenders. Treat Microsoft’s advisory as authoritative for patch status and CVE assignment even if other trackers add additional context. (msrc.microsoft.com)
Context: why this matters for confidential computing
Confidential Containers promise to shift trust assumptions in cloud computing: instead of trusting the cloud operator to never access plaintext secrets, customers can place high‑value workloads inside TEEs and rely on attestation guarantees. But that model is only as strong as the implementation that surrounds it — orchestration, secret distribution, attestation, and the control plane must all preserve confidentiality.
This vulnerability is particularly consequential because:
- Secrets are the currency of cloud environments. Service principals, access tokens, and keys let actors call management APIs or pivot between services rapidly.
- Cloud orchestration layers are central points of concentration. A flaw in the infrastructure that provisions or stores secrets undermines downstream guarantees even if the TEE itself remains intact.
- Multi‑tenant scale increases blast radius. A mis‑handled secret in a shared control plane can enable cross‑tenant access patterns if attackers obtain credentials that are valid more broadly than the initial host.
Exploitability and observed activity
Public reporting from Microsoft and multiple security vendors indicates:
- CVE‑2026‑23655 is actionable under the right conditions, but exploitation requires an attacker to have authorized access (for example a compromised credential, a flawed service account, or an environment with overly permissive network controls). It is not described as a purely unauthenticated remote code execution vector.
- At the time of disclosure, vendors and NVD trackers reported no confirmed widespread active exploitation of CVE‑2026‑23655; Microsoft’s Patch Tuesday materials prioritized remediation and rotation but did not assert active in‑the‑wild abuse for this CVE specifically (Microsoft flagged other CVEs in the same month as actively exploited).
- Adjacent ACI vulnerabilities — especially some elevation‑of‑privilege issues — were treated as higher‑urgency items because they could more directly convert low‑privilege footholds into host control. Because real‑world attacks often chain multiple weaknesses, defenders should assume chaining risk (an initial foothold + this disclosure bug → tenant compromise).
In short: CVE‑2026‑23655 is dangerous because it amplifies other access problems; it is not, by itself, a public wormable remote RCE — but it materially increases the consequences of existing compromises.
Confirmed severity and scoring
Multiple trackers put the information disclosure vulnerability at
CVSS 3.x ~ 6.5 (medium‑high). The NVD and vendor analyses list the problem as
important and urge immediate application of Microsoft’s fixes where applicable. The related elevation‑of‑privilege CVE‑2026‑21522 received a similar but distinct severity rating in vendor commentary (CVSS ~6.7). These numeric scores reflect a compromise between exploitability prerequisites (an attacker needs authorized access) and impact (disclosure of highly sensitive secrets).
Recommended immediate actions (playbook)
Apply the patch is the unequivocal first step — but because this is a secrets disclosure class bug, remediation must be extended into operational hygiene. The following prioritized playbook gives defenders a tested path.
- Patch and verify
- Apply the Microsoft updates released during the February 2026 security release to every ACI Confidential Containers instance and related Azure Compute Gallery components in your environment. If your tenant uses managed services, confirm that Microsoft has rolled fixes in your region and subscription. (msrc.microsoft.com)
- Rotate and revoke secrets
- Immediately rotate any tokens, keys, service principal credentials, and managed identity keys that were used by workloads running in affected Confidential Containers. Treat rotation as compulsory for credentials that could have been exposed.
- Limit blast radius
- Enforce least privilege on service principals, limit role assignments, and audit the scope of any credentials that could grant broad tenant access.
- Harden network access
- Restrict network paths to ACI control endpoints, place management interfaces behind private endpoints, and use network security groups (NSGs) and conditional access policies to reduce unauthorized access vectors.
- Audit and hunt
- Hunt for suspicious activity: abnormal token usage, tokens used from unexpected source IPs, unanticipated API calls to resource management endpoints, or new resource creation around the disclosure window. (Examples of telemetry sources: Azure Activity Logs, Azure AD sign‑in logs, Container Insights, and any EDR telemetry that captures process calls inside confidential guests.)
- Monitor for attempted chaining
- Treat OOB (out‑of‑band) post‑compromise actions — new virtual machines, role changes, key vault access — as high priority incidents and investigate relentlessly.
- If you cannot patch immediately
- Temporarily restrict deployment of confidential workloads, remove sensitive secrets from runtime images, and disable mounting mechanisms that surface secrets to guest filesystems.
- Engage support and document
- Open a support ticket with Microsoft if you suspect your tenant was impacted; preserve logs and time‑stamped evidence before rotating credentials for forensic investigation.
Detection and hunting guidance (practical queries and indicators)
Successful detection requires stitching Azure telemetry with identity logs. Use the following high‑level heuristics as starting points.
- Identity anomalies
- Look for unusual service principal token activity: tokens used from IP addresses outside expected geolocation ranges or tokens used at odd hours.
- Token misuse
- Detect API calls that retrieve large numbers of secrets, list role assignments, or request Key Vault data using credentials that should not normally perform those operations.
- Resource anomalies
- Watch for sudden creation of resources in management groups or new role assignments to service prih confidential workloads.
- Runtime traces
- Monitor container runtime logs inside confidential guests for unexpected processes reading secret stores or writing secrets to filesystem artifacts.
- KQL examples (conceptual)
- Search ActivityLogs for "SecretGet" or "KeyVaultAccess" correlated to the identity used by an ACI Confidential instance.
- Correlate Azure AD sign‑ins with resource management API calls within a short time window.
Note: tailor the above to your organization’s baseline; false positives will be common without contextual enrichment.
Why vendor response and transparency matter
Microsoft’s role as the platform operator means its advisory and patch distribution are the canonical sources for status and remediation. Third‑party security vendors — CrowdStrike, Qualys, RedmondMag’s analysts, and others — independently analyze and annotate Microsoft’s advisories to help defenders prioritize, but they do not replace vendor patches. The MSRC Security Update Guide remains the authoritative record for Microsoft’s CVE mapping, even though some automated crawlers or feeds may show delayed or truncated content. (
msrc.microsoft.com)
Strengths of the vendor response this cycle:
- Microsoft bundled fixes into a scheduled Patch Tuesday, enabling predictable remediation windows and coordinated vendor communications.
- Multiple security vendors rapidly mirrored the advisory and produced playbooks to assist customers in rotation and detection efforts.
Limitations and residual risks:
- Secrets rotated after a breach may already have been used to create persistent footholds (backdoors, delegated service principals) — rotation must be combined with exhaustive hunt and revocation policies.
- TEEs mitigate a class of threats but do not absolve the control plane and secret lifecycle problems that arise outside the TEE boundary; the control plane remains a high‑value target. ([learn.microsomicrosoft.com/en-us/azure/aks/confidential-containers-overview)
Deeper technical caveats and open questions
- Attribution of exploitation: public sources stated no confirmed active exploitation for CVE‑2026‑23655 at disclosure time, but absence of public evidence is not proof that attackers did not abuse the flaw in private. Treat this as a high‑urgency hardening problem.
- Scope and affected versions: vendor advisories list affected ACI Confidential components and versions; the operational impact depends on whether customers run ACI Confidential Containers or AKS Confidential workloads and the exact version of the Azure Compute Gallery stack used in each region. Always verify patch status in your subscription and region.
- Underlying root cause detail: public writeups characterize the flaw as cleartext storage / insufficient protection of secrets at rest or in transit within the supporting compute gallery, but Microsoft’s public advisory text is intentionally concise; defenders should rely on the vendor’s update guidance and the NVD enrichment for CVSS/context while using vendor telemetry to search for indicators. When vendor advisories omit low‑level code diffs, assume you must rely on operational mitigations rather than code inspection.
Where independent corroboration exists, I’ve cited it; where vendor‑only statements appear, treat them as authoritative pending public patches and third‑party analyses.
Broader lessons for confidential computing and cloud operators
- Secrets handling is a foundational control. Hardware TEEs protect runtime confidentiality but are ineffective if orchestration, vaulting, or control‑plane services mishandle secrets.
- Defense‑in‑depth must include:
- Proper secret vaulting and short‑lived tokens
- Strong isolation between management and runtime planes
- Least privilege and just‑in‑time elevation for service principals
- Incident readiness must consider token theft as an initial access pattern; rotation and aggressive hunt should be the default reaction to any information‑disclosure event.
- Vendor coordination is essential: cloud operators must provide clear per‑region remediation and rapid revocation tools to tenants because secrets abuse can cascade across services in minutes.
Academic work and independent architectures for confidential containers continue to highlight the complexity of minimizing trusted computing base (TCB) size and the importance of minimizing the attack surface that touches secrets — lessons echoed by this advisory.
Action checklist for administrators (concise)
- [ ] Confirm whether any workloads use ACI Confidential Containers or AKS Confidential features.
- [ ] Apply Microsoft’s February 2026 ACI Confidential Containers updates immediately in all affected regions. (msrc.microsoft.com)
- [ ] Rotate all tokens, service principals, and keys associated with confidential workloads; force revocation where possible.
- [ ] Hunt with Azure Activity Logs, Azure AD sign‑in logs, Key Vault logs and Container Insights for abnormal token use.
- [ ] Restrict permissions on service principals and limit network access to control plane endpoints.
- [ ] Document the mitigation steps and open a support case with Microsoft if you suspect exposure.
Final analysis: measured urgency, clear remediation path
CVE‑2026‑23655 is a serious information‑disclosure vulnerability because it targets secrets that enable attack escalation in cloud tenants. That said, its exploitability requires preconditions (authorized access or a foothold) which moderates the immediacy when compared with unauthenticated remote RCEs. The overall operational urgency is high for organizations using ACI Confidential Containers because the value of compromised tokens is extreme — the impact of even a single leaked service principal credential can be enormous in a cloud tenant.
Microsoft’s coordinated patching in February 2026, alongside rapid coverage by security vendors and NVD entry updates, gives defenders both the fix and the context needed to respond. The most consequential actions are not just applying updates, but rapid secret rotation, comprehensive hunt efforts, and longer‑term architectural hardening of how secrets are issued, stored, and consumed around confidential workloads.
If you run confidential workloads in Azure, treat this advisory as actionable today: patch, rotate, hunt, and harden. The hardware guarantees of TEEs are only as valuable as the ecosystem that issues and protects the secrets that enable them.
Conclusion: Microsoft fixed a dangerous but not trivially exploitable information disclosure in the ACI Confidential Containers control plane; defenders must assume token exposure is possible, move quickly on remediation and rotation, and use this incident to audit and strengthen their secret‑management and orchestration practices.
Source: MSRC
Security Update Guide - Microsoft Security Response Center