CVE-2026-85891: Azure HDInsight Information Disclosure Flaw

CVE-2026-85891 Overview

CVE-2026-85891 is an information disclosure vulnerability in Microsoft Azure HDInsight. The flaw allows an unauthenticated attacker to retrieve sensitive information over a network. Microsoft tracks the issue under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

The vulnerability requires no privileges and no user interaction. An attacker needs only network reachability to a vulnerable HDInsight endpoint to retrieve data they should not be able to access. The confidentiality impact is high, while integrity and availability are not affected.

Critical Impact
An unauthenticated remote attacker can disclose sensitive information from Azure HDInsight clusters over the network without any user interaction.

Affected Products

Microsoft Azure HDInsight

Discovery Timeline

2026-10-13 - CVE CVE-2026-85891 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85891

Vulnerability Analysis

Azure HDInsight is Microsoft's managed analytics service that runs open-source frameworks such as Apache Hadoop, Spark, Kafka, and HBase. The service exposes several management, submission, and data-access endpoints that typically require authentication and access control.

This vulnerability breaks that access boundary for a confidentiality-sensitive code path. An unauthorized actor can reach data that should be restricted to authenticated and authorized principals. Because the attack vector is the network and no privileges are required, exposure extends to anyone who can route packets to the affected endpoint.

The EPSS probability sits at 0.923% as of 2026-10-14, indicating a modest near-term exploitation forecast. Microsoft has not published indicators that the flaw is being exploited in the wild, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is classified under [CWE-200]. A component in Azure HDInsight returns sensitive information to a caller that lacks the authorization to receive it. Microsoft has not published a detailed technical breakdown of the vulnerable component, pipeline, or request path.

Attack Vector

The attack vector is network-based. An attacker sends crafted requests to an exposed HDInsight interface and parses the response for sensitive content. No authentication, no privileges, and no user interaction are required. Refer to the Microsoft Security Update Guide for CVE-2026-85891 for Microsoft's authoritative description.

No verified proof-of-concept code is publicly available, and no exploit entries exist in Exploit-DB. The vulnerability mechanism is described in prose because no sanitized exploitation code has been released by the vendor or researcher.

Detection Methods for CVE-2026-85891

Indicators of Compromise

Unexpected unauthenticated HTTP or HTTPS requests to Azure HDInsight gateway, Ambari, or workload endpoints originating from untrusted networks.
Anomalous spikes in response sizes from HDInsight management or data endpoints to external or unauthenticated callers.
Access patterns from IP ranges outside documented administrative sources targeting HDInsight cluster FQDNs.

Detection Strategies

Enable Azure HDInsight diagnostic logging and forward gateway, Ambari, and application logs to a central analytics backend for review.
Correlate requests to HDInsight endpoints with Microsoft Entra ID sign-in logs to flag access attempts without a matching authentication event.
Baseline normal data egress volumes from HDInsight clusters and alert on deviations consistent with bulk information retrieval.

Monitoring Recommendations

Monitor Azure Activity Logs and Network Security Group (NSG) flow logs for new or unexpected inbound connections to HDInsight subnets.
Alert on access to HDInsight public endpoints from geographies or ASNs outside your approved operational scope.
Track Microsoft Defender for Cloud recommendations and alerts tagged to HDInsight resources.

How to Mitigate CVE-2026-85891

Immediate Actions Required

Review the Microsoft Security Update Guide for CVE-2026-85891 and apply the service update or cluster image guidance Microsoft provides.
Inventory all Azure HDInsight clusters across subscriptions and confirm each is on a supported, patched image version.
Restrict inbound network access to HDInsight gateway and management endpoints using NSGs, private endpoints, or virtual network injection.

Patch Information

Microsoft tracks remediation through the Microsoft Security Update Guide for CVE-2026-85891. For managed service components, Microsoft typically applies fixes to the HDInsight platform directly, while customer-managed cluster images may require redeployment or an in-place image update. Confirm the required action for each cluster SKU in your environment against Microsoft's guidance.

Workarounds

Place HDInsight clusters inside a virtual network and disable public endpoints where business requirements allow.
Enforce Microsoft Entra ID authentication and conditional access policies for all HDInsight access paths.
Limit administrative and submission endpoints to specific source IP ranges through NSG rules until the patched image is deployed.

bash

# Example: restrict HDInsight gateway access to an allowlisted admin CIDR
az network nsg rule create \
  --resource-group <rg-name> \
  --nsg-name <hdinsight-nsg> \
  --name Allow-HDInsight-Admin \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes <admin-cidr> \
  --destination-port-ranges 443

az network nsg rule create \
  --resource-group <rg-name> \
  --nsg-name <hdinsight-nsg> \
  --name Deny-HDInsight-Public \
  --priority 4000 \
  --direction Inbound \
  --access Deny \
  --protocol '*' \
  --source-address-prefixes Internet \
  --destination-port-ranges '*'