Cross-Tenant Credential Exposure in Azure OpenAI through Manipulated Model Deployment Logging
Overview
A high-severity information disclosure vulnerability was discovered in the Microsoft Azure OpenAI Service. The vulnerability allowed an authenticated but low-privileged user in one tenant to potentially access transient deployment credentials and configuration details from other tenants. The root cause was an improper input validation flaw in the logging mechanism for custom model deployments. When a user submitted a fine-tuning job with a specially crafted model source URL containing newline characters and other control sequences, the backend logging service would incorrectly parse the log entry. This could cause a portion of a subsequent log entry from a different tenant's deployment process—which might contain short-lived SAS tokens or internal storage account names—to be appended to the attacker's visible error log. While the window of opportunity was small, a persistent attacker could automate this process to harvest sensitive information, potentially allowing them to access other customers' private model data. The issue was reported responsibly by security researchers at Wiz.io, and Microsoft has since patched the logging service to properly sanitize all user-provided input before writing to shared log streams. There is no evidence that this vulnerability was exploited in the wild.
Affected Systems
Testing Guide
1. This vulnerability was a backend cloud infrastructure issue and cannot be tested directly by customers. 2. Review your Azure Service Health dashboard and security advisories for notifications related to this incident (portal ID `AZ-2026-58193`). 3. Review historical logs for your Azure OpenAI resources for any anomalies or unexpected error messages during the affected period, particularly those related to fine-tuning jobs.
Mitigation Steps
1. No direct user action is required, as Microsoft has patched the vulnerability on the Azure backend. 2. It is recommended to rotate any storage account keys or credentials that were used for custom model fine-tuning or deployment between January 2026 and June 2026 as a precautionary measure. 3. Enable Azure Monitor and configure detailed logging for all AI service interactions to aid in future forensic analysis. 4. Regularly review IAM roles and access policies associated with your Azure AI resources to ensure the principle of least privilege is maintained.
Patch Details
The vulnerability was mitigated by Microsoft on the Azure backend on June 28, 2026. All Azure regions and services are protected.