Cross-Tenant Data Leakage in Azure OpenAI Fine-Tuning Service
Overview
The security firm Wiz reported a high-severity information disclosure vulnerability in the Azure OpenAI Fine-Tuning service. The vulnerability stemmed from an improper authorization check in the backend architecture that handles customer training data. When a user submitted a fine-tuning job, the service copied the training data from the user's private storage to a temporary, multi-tenant Azure Blob Storage container for processing by the training cluster. Due to a race condition combined with a flawed Shared Access Signature (SAS) token scoping mechanism, a malicious actor in one Azure tenant could craft a specific API request at the precise moment another tenant's job was being initialized. This allowed the attacker's process to gain read access to the training data file of the victim tenant being processed concurrently. An attacker could potentially download highly sensitive proprietary datasets that other customers were using to fine-tune their models, leading to a major breach of data confidentiality. Microsoft Security Response Center (MSRC) was notified under coordinated disclosure, acknowledged the issue, and has deployed a fix that enforces strict tenant isolation in the backend storage layer and revamps the SAS token generation logic. Microsoft stated that a review of service logs showed no evidence of this vulnerability being exploited by external actors.
Affected Systems
Testing Guide
This vulnerability was on the cloud provider's side and cannot be tested by customers. Microsoft has confirmed the issue is resolved.
Mitigation Steps
1. **No User Action Required:** The vulnerability existed in the Azure cloud backend and has been patched by Microsoft across all regions. Customer action is not required to be protected. 2. **Precautionary Secret Rotation:** As a security best practice, customers who performed fine-tuning jobs before the patch date (2025-11-01) should consider rotating any secrets, keys, or PII that may have been present in their training datasets.
Patch Details
Patched server-side by Microsoft on 2025-11-01. Details were publicly disclosed on 2025-11-10 after a customer notification period.