Cross-Tenant Data Exposure in Azure AI Search via Managed RAG Service
Overview
A critical vulnerability was discovered in the Azure OpenAI managed Retrieval-Augmented Generation (RAG) service that could allow an attacker to access sensitive data from other tenants. The issue stemmed from improper authorization validation within the internal API gateway that proxies requests to Azure AI Search (formerly Cognitive Search) instances backing the RAG service. Authenticated users could craft a specific API request containing a manipulated 'x-ms-search-instance-id' header. The validation logic failed to properly check if the user's AAD token was authorized for the specified search instance, instead only validating the token's general signature. This allowed an attacker in one tenant to enumerate and query private search indexes belonging to another tenant by iterating through instance IDs. The impact is severe, as it enables the exfiltration of confidential data used in enterprise RAG applications, such as internal documents, customer data, and proprietary knowledge bases, completely bypassing tenant isolation boundaries. Microsoft's security team discovered this during an internal audit and has since patched the API gateway logic.
Affected Systems
Testing Guide
1. This vulnerability was patched at the Azure infrastructure level and is no longer directly testable by customers. 2. To verify security posture, you can attempt to make a REST API call to your Azure AI Search instance's API endpoint using an authentication token from a user principal belonging to a *different* Azure tenant. 3. The expected (and correct) result is an HTTP `401 Unauthorized` or `403 Forbidden` error, indicating that cross-tenant access is blocked.
Mitigation Steps
1. No user action is required for the service-side patch; Microsoft has updated the Azure infrastructure globally. 2. Rotate all credentials and API keys associated with Azure AI Search and Azure OpenAI services as a precautionary measure. 3. Review Azure Activity Logs and AI Search diagnostic logs for any anomalous query patterns or access attempts between April and June 2026. 4. Implement network security rules on your Azure AI Search instances to only allow traffic from your specific, trusted VNet, providing an additional layer of defense.
Patch Details
The vulnerability was patched by Microsoft on the service side on or around 2026-06-18. No specific version number is applicable for users.