CVE-2024-21638: Azure IPAM solution Elevation of Privilege Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-10 · updated 2026-06-17
Weakness: CWE-269

Description

Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.

Affected products

Azure ipam: before 3.0.0 — fixed in 3.0.0
Azure ipam: before 3.0.0

How to fix

Upgrade to a fixed version: Azure ipam 3.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-21638 or the next vulnerability affects your stack