Product:
Azure Compute Gallery
Summary
Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network. This vulnerability poses a risk to the confidentiality of sensitive data. Attackers with low privileges can exploit this issue without user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-23655 |
Exploitation
To exploit this vulnerability, an attacker must have authorized access to the Azure Compute Gallery. Once access is obtained, the attacker can retrieve sensitive information stored in cleartext, potentially leading to data breaches. The attack can be executed over the network, making it relatively easy for an attacker to exploit if they have the necessary permissions.
Affected Products
- Azure Compute Gallery: A service that allows users to manage and share images for virtual machines.
Mitigation
To mitigate this vulnerability, it is recommended to implement encryption for sensitive information stored in Azure Compute Gallery. Regular audits and access controls should also be enforced to limit unauthorized access. Users should ensure that they are following best practices for data protection and security.