Confused Deputy Flaws Expose Admin Access in Google Cloud and Azure

A class of vulnerabilities known as 'Confused Deputy' flaws continues to plague major cloud platforms, including Google Cloud and Microsoft Azure, according to researchers tracking persistent identity and access management weaknesses. These flaws exploit the trust relationship between cloud services that hold elevated privileges and the identities that invoke them, allowing attackers to escalate from low-level access to administrative control without needing to compromise credentials directly. The attack pattern weaponizes the principle that cloud resource management APIs often inherit permissions from one identity while being called by another, creating a dangerous privilege boundary mismatch.

Security teams at Wiz and other research firms have documented multiple instances where attackers could leverage confused deputy issues to bypass role-based access controls (RBAC) and identity-and-access-management (IAM) policies in both Google Cloud Platform (GCP) and Microsoft Azure environments. In several cases, misconfigured service agents and managed identities could be tricked into performing actions on behalf of the attacker, effectively granting them admin-level permissions. These are not theoretical issues—similar confused deputy vulnerabilities, such as the well-documented Azure AutoWarp flaw disclosed in 2022, have led to real-world exposure of customer secrets and tokens across thousands of cloud instances.

For organizations relying on multi-cloud or hybrid deployments, the persistence of these vulnerabilities underscores the need for continuous auditing of IAM policies, service account permissions, and trust boundaries between cloud resources. Security teams should regularly review which identities can invoke which services and monitor for anomalous cross-service authorization calls. Administrators can audit their own external exposure using our port scanner to identify unintentionally open cloud endpoints, and validate their certificate configurations with the SSL/TLS checker to ensure encrypted communications are not weakened by misconfigurations that confused deputy attacks often exploit.

Cloud providers have introduced mitigations such as conditional access policies, workload identity federation, and stricter default permissions for service accounts, but researchers warn that the underlying architectural pattern remains vulnerable to developer error. Organizations should adopt a least-privilege posture for all cloud identities and conduct regular penetration tests focusing on cross-service trust relationships. A full privacy checkup of your organization's cloud footprint can help surface misconfigured permissions and exposed services before attackers find them.