Microsoft rejects critical Azure vulnerability report; no CVE issued

A security researcher claims that Azure Backup for AKS contained a critical privilege-escalation flaw allowing a user with only the Backup Contributor role to obtain cluster-admin access in Kubernetes. Microsoft disputes that this was a security vulnerability and says the behavior was expected and that no product changes were made. CERT/CC did not independently validate the issue; the case was closed and no CVE was issued.