The vulnerability stems from improper handling of IMDS probe requests in managed identity scenarios. The changelog explicitly states that pre-1.11.0 versions of DefaultAzureCredential used retries for IMDS probes, which could lead to prolonged exposure of credential metadata or error leakage. The patch in 1.11.0 specifically addresses this by eliminating retries. Both ManagedIdentityCredential (the component interacting directly with IMDS) and DefaultAzureCredential (the credential chain coordinator) are implicated in this behavioral change, making their token acquisition methods the most likely vulnerable points.