Cross-Tenant Metadata Exposure in Azure OpenAI Service via API Error Side-Channel
Overview
Microsoft disclosed and patched a medium-severity information disclosure vulnerability in its Azure OpenAI Service. The flaw allowed for potential cross-tenant metadata exposure under specific, rare conditions. The vulnerability was a race condition in the service's API gateway error handling logic. When a malformed request was sent to a shared model endpoint (e.g., GPT-4) during a period of high server load, it could trigger an unhandled exception. The default error serialization process would then inadvertently capture and return a small snippet of metadata from another request that was being processed concurrently on the same worker thread. This other request could belong to a different Azure customer/tenant. The exposed metadata was limited and did not include full prompts, API keys, or responses. However, it could include fragments such as the model ID being used, the timestamp of the request, and the first few characters of the prompt or custom user identifier. While the direct impact was limited, this information could be valuable for reconnaissance, allowing an attacker to learn about the usage patterns, models, and potentially the nature of the applications of other Azure OpenAI customers. Microsoft's security team discovered the issue during internal audits and stress testing. They have since deployed a patch that ensures strict isolation of error handling contexts for each request, preventing any cross-tenant data leakage.
Affected Systems
Testing Guide
1. This vulnerability was patched on the server-side and is no longer reproducible. 2. Confirmation that you are not affected involves ensuring your application is connecting to the standard, up-to-date Azure OpenAI service endpoints. 3. Historical analysis can be performed by reviewing logs from before the patch date (2026-02-18) for API error responses that contained unexpected metadata fragments.
Mitigation Steps
1. No user-side action is required as the patch was deployed by Microsoft on the Azure infrastructure. 2. Review application logs for any anomalous error messages from the Azure OpenAI API during the vulnerability window (prior to 2026-02-18). 3. Follow security best practices by implementing robust error handling in your application to prevent sensitive information from being logged or exposed to end-users, regardless of the API's behavior. 4. Utilize Azure's monitoring and alerting features to detect unusual patterns of API errors that could indicate a new or similar issue.
Patch Details
The vulnerability was patched on the server-side by Microsoft on 2026-02-18. No user action is required.