Cross-Tenant Data Access Vulnerability in Azure OpenAI Fine-Tuning Service
Overview
Microsoft addressed a high-severity information disclosure vulnerability in the Azure OpenAI Service. The flaw allowed a potential cross-tenant data access scenario related to the fine-tuning feature. The vulnerability stemmed from an insufficient access control check in the backend API that initiates fine-tuning jobs. An authenticated attacker in their own Azure tenant could craft a malicious API request to start a new fine-tuning job, but point the data source parameter to a file within a private Azure Blob Storage container belonging to a different Azure tenant. While the attacker would need to guess or otherwise discover the specific storage account and container name of a target, the service failed to properly validate that the identity initiating the job had explicit permission to read from that specific storage location. If a valid path was provided, the Azure OpenAI service would use its own elevated privileges to access the data and begin the fine-tuning process. This could allow an attacker to indirectly exfiltrate sensitive training data by observing the behavior and outputs of the resulting fine-tuned model. The vulnerability was discovered by security researchers at Wiz.io and was responsibly disclosed to Microsoft. Microsoft has since patched its backend infrastructure to enforce stricter validation of data source permissions against the caller's identity.
Affected Systems
Testing Guide
1. This vulnerability was on the Azure backend and has been patched, so it is no longer possible to test for it directly. 2. You can verify your security posture by attempting to access a private storage blob from an unauthorized location or using an identity without explicit permissions. The request should be denied. 3. Review your Azure OpenAI and Storage Account configurations to ensure they align with security best practices, such as using managed identities for service-to-service authentication.
Mitigation Steps
1. The primary vulnerability was patched by Microsoft on the server side; no customer action is required to fix the root cause. 2. As a best practice, use Azure Private Endpoints to restrict network access to your storage accounts, allowing access only from trusted virtual networks. 3. Implement strict Identity and Access Management (IAM) policies on storage accounts, granting the minimum required permissions. 4. Regularly audit access logs for your Azure Blob Storage accounts to identify any anomalous or unauthorized access patterns.
Patch Details
The vulnerability was patched on Microsoft's backend. No user action is required. The fix was rolled out globally by 2026-02-14.