MapRoot: A Tale of Two Zero-Days, Two Patches, Two Bypasses Leading to Cross-Tenant RCE on Microsoft Planetary Computer
Two zero-days in numexpr and GDAL gave us code execution inside Microsoft Planetary Computer. The real impact was RBAC: a popped pod could access cross-tenant secrets. Microsoft downgraded it, then quietly removed the permissions, and later reversed it back to critical.
