Extension-secret disclosure via attacker-controlled transport certificates

Information disclosure across affected Microsoft Azure services allows local users to read VM extension secrets from Linux guests. The Wire Server certificate endpoint accepted an attacker-generated transport certificate and returned extension decryption keys, while an alternate endpoint address bypassed the root-only packet filter. An unprivileged guest or container user could decrypt protectedSettings and, when VMAccess stored an administrator password, elevate privileges or reuse that credential across virtual machines.