Cross-Tenant Data Exfiltration in Azure OpenAI via Misconfigured Service Tag Routing
Overview
A high-severity vulnerability was discovered in the Azure OpenAI Service's networking implementation. When a customer configured a Private Endpoint for their OpenAI resource, it was still possible for specially crafted packets to bypass the intended network isolation. The flaw stemmed from an overly permissive default rule associated with the 'AzureCognitiveServicesManagement' service tag. An authenticated attacker on a compromised VM within the same Azure region, even in a different tenant's VNet, could leverage this routing misconfiguration to send discovery probes to the Azure OpenAI management plane. Under specific conditions, this could be escalated to exfiltrate metadata about fine-tuned models, and in some cases, portions of the training data filenames. The attack required significant knowledge of Azure's internal network architecture and was not trivial to execute. However, it represented a fundamental break in the tenant isolation promised by Private Endpoints for sensitive AI workloads. The discovery was made by an external security research firm during a red team engagement and was promptly reported to Microsoft.
Affected Systems
Testing Guide
1. Navigate to the NSG associated with the subnet hosting your Azure OpenAI Private Endpoint. 2. Examine the outbound rules. If there are rules allowing traffic to the `AzureCognitiveServicesManagement` service tag with a destination port of `*` or `443`, your configuration may be vulnerable. 3. From a VM within the same VNet, attempt to run `nslookup <your-openai-resource-name>.openai.azure.com`. It should resolve to a private IP address. If it resolves to a public IP, your private DNS zone may be misconfigured, increasing risk.
Mitigation Steps
1. Review and tighten Network Security Group (NSG) rules for your Azure OpenAI resources. Specifically, restrict outbound traffic to only known and required IP ranges, avoiding permissive 'Any' rules. 2. In the Azure Portal, navigate to your Azure OpenAI resource's networking tab and select the option to 'Regenerate' the private endpoint configuration, which applies the new, more secure routing logic. 3. Implement Azure Policy to audit for and prevent the use of overly broad service tags in NSGs associated with AI/ML workloads. 4. Ensure all management traffic is routed through a bastion host or secure administrative workstation.
Patch Details
Microsoft deployed a backend fix to the service tag routing logic on 2026-06-18. Customers are advised to regenerate their private endpoint configurations to fully benefit from the patch.