Cross-Tenant Data Leakage in Azure OpenAI Fine-Tuning Service via GPU Memory Remnants
Overview
A critical vulnerability was discovered in the Microsoft Azure OpenAI fine-tuning service that could lead to cross-tenant data leakage. The issue stemmed from improper memory cleanup on shared GPU infrastructure used for fine-tuning jobs. When a customer's fine-tuning job completed or failed, the GPU memory (VRAM) allocated to it was not always fully zeroed out before being re-allocated to the next customer's job in the queue. A sophisticated attacker could start a fine-tuning job with a specially crafted model that, instead of training, would immediately attempt to read and dump the existing contents of the VRAM. If this job was scheduled on a GPU immediately after another tenant's job, it could capture fragments of the previous tenant's private training data. The leaked data could include proprietary code, personal identifiable information (PII), or other sensitive corporate data used for model customization. The vulnerability was discovered by security firm Wiz.io and required precise timing to exploit, but the impact is considered critical due to the potential breach of sensitive customer training data. Microsoft has since deployed a fix that enforces a mandatory, blocking memory-scrubbing operation between all fine-tuning jobs on shared hardware, ensuring data from one tenant is cryptographically erased before resources are provisioned to another.
Affected Systems
Testing Guide
External testing for this vulnerability is not feasible as it requires specific timing and control over the cloud provider's internal infrastructure scheduling. Customers should rely on the official advisory and confirmation of the patch from Microsoft (Security Advisory MSRC-2026-07-A01).
Mitigation Steps
1. This vulnerability was patched on the server-side by Microsoft. No user action is required. 2. Review Azure service health notifications and security advisories to confirm your services are no longer at risk. 3. For future high-sensitivity workloads, consider using dedicated hardware resources if available and economically feasible. 4. Rotate any secrets or credentials that may have been present in fine-tuning datasets used before the patch date as a precautionary measure.
Patch Details
The issue was resolved globally by Microsoft on their infrastructure by 2026-07-03. No specific version update is required by customers.