CVE-2021-42306

An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential  on an Azure AD Application or Service Principal (which is not recommended). This vulnerability allows a user or service in the tenant with application read access to read the private key data that was added to the application. Azure AD addressed this vulnerability by preventing disclosure of any private key values added to the application. Microsoft has identified services that could manifest this vulnerability, and steps that customers should take to be protected. Refer to the FAQ section for more information. For more details on this issue, please refer to the MSRC Blog Entry.

• CWE-522

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42306Patch, Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42306Patch, Vendor Advisory

Published

Nov 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42300Azure Sphere Tampering Vulnerability6
• CVE-2021-42301Azure RTOS Information Disclosure Vulnerability3.3
• CVE-2021-42302Azure RTOS Elevation of Privilege Vulnerability6.6
• CVE-2021-42303Azure RTOS Elevation of Privilege Vulnerability6.6
• CVE-2021-42304Azure RTOS Elevation of Privilege Vulnerability6.6
• CVE-2021-42305Microsoft Exchange Server Spoofing Vulnerability6.5
• CVE-2021-42307Microsoft Edge (Chromium-based) Information Disclosure Vulne…4.3
• CVE-2021-42308Microsoft Edge (Chromium-based) Spoofing Vulnerability3.1
• CVE-2021-42309Microsoft SharePoint Server Remote Code Execution Vulnerabil…8.8
• CVE-2021-4231A vulnerability was found in Angular up to 11.0.4/11.1.0-nex…5.4
• CVE-2021-42310Microsoft Defender for IoT Remote Code Execution Vulnerabili…9.8
• CVE-2021-42311Microsoft Defender for IoT Remote Code Execution Vulnerabili…10