Vulnerable Azure Kubernetes Service should be updated to resolve vulnerability findin

Harithasan R 20 Reputation points
2026-08-22T05:52:35.38+00:00

Azure Defender for Cloud reports:

"Vulnerable Azure Kubernetes Service should be updated to resolve vulnerability findings"

My AKS cluster was upgraded:

1.33.3 → 1.34.9 → 1.35.7

Current Kubernetes version:

1.35.7

Current node image:

AKSUbuntu-2404gen2containerd-202608.14.0

Defender still reports vulnerabilities in AKS-managed components such as:

  • azure-ip-masq-agent
  • azuredisk
  • node-driver-registrar
  • metrics-server

For example:

azure-ip-masq-agent:

mcr.microsoft.com/oss/v2/azure/ip-masq-agent-v2:v0.1.16-14

Reported CVEs:

  • CVE-2025-4802
  • CVE-2025-1767

What is the correct way to resolve this recommendation?

Do I need to upgrade Kubernetes to 1.36.x, upgrade the node image, or wait for an AKS component update?

Azure Kubernetes Service
Azure Kubernetes Service

An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.

0 comments
Answer accepted by question author
SUNOJ KUMAR YELURU 18,736 Reputation points MVP Volunteer Moderator
2026-08-23T06:00:50.1933333+00:00

Hello @Harithasan R

You are already on the correct fix path: 1.35.7 + latest node image.

Those CVEs are in AKS-managed add-ons (azure-ip-masq-agent v0.1.16-14 etc), not in Kubernetes itself. Node image updates don't fix them.

Correct way:

Force add-on rollout - re-run upgrade on same version: az aks upgrade -g <RG> -n <CLUSTER> --kubernetes-version 1.35.7 and az aks nodepool reimage -g <RG> --cluster-name <CLUSTER> -n <POOL>

Check tag: kubectl get ds -n kube-system azure-ip-masq-agent -o jsonpath='{.spec.template.spec.containers[0].image}' If it's still v0.1.16-14, AKS hasn't published a patched image for 1.35 yet in your region.

Wait. Defender rescans every 24h. Once Microsoft pushes v0.1.16-15+ it will auto-update and the finding clears in 24-72h.

check https://github.com/Azure/AKS/releases

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

Was this answer helpful?

1 person found this answer helpful.
0 comments

0 additional answers

Sort by: Newest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.