Cross-Tenant Model Access in Azure OpenAI Studio via SSRF
Overview
A high-severity Server-Side Request Forgery (SSRF) vulnerability was discovered in the Azure OpenAI Studio's 'Bring your own data' feature. This feature allows users to connect their OpenAI models to various data sources, including web pages via a URL. Researchers found that the service responsible for fetching data from user-provided URLs lacked proper validation and segregation for internal Azure network addresses. An attacker could provide a specially crafted URL pointing to an internal metadata service endpoint within the Azure fabric. By manipulating the request path and headers, an attacker authenticated to their own Azure tenant could send requests to the internal API that manages model deployments. This flaw allowed the attacker to bypass standard authorization checks and query the metadata of fine-tuned models belonging to other tenants hosted in the same region. While direct access to model weights was not possible, the vulnerability exposed sensitive metadata, including custom model names, base model versions, and fine-tuning job details. In a limited number of configurations, it was also possible to invoke the inference endpoint of another tenant's model if its deployment ID could be enumerated, leading to a significant cross-tenant data and resource access breach. Microsoft has since patched the vulnerability by implementing stricter network controls and validating all user-supplied URLs against an explicit deny-list of internal IP ranges and hostnames.
Affected Systems
Testing Guide
1. This vulnerability was a server-side issue and cannot be tested by end-users post-patch. 2. To test if your configuration was potentially vulnerable before the patch, review the 'Data files source' URLs configured in your Azure OpenAI Studio Chat playground deployments. 3. If any URL pointed to a publicly accessible but attacker-controllable resource, it could have been used as a vector. Check the access logs for those resources for unusual requests originating from Microsoft Azure IP ranges.
Mitigation Steps
1. No direct user action is required, as Microsoft has patched the vulnerability on the server side. 2. Review Azure Activity Logs for any suspicious activity related to the 'Bring your own data' feature or unusual model invocations between the vulnerability disclosure date and the patch date. 3. Restrict network access for data sources connected to Azure AI services to known and trusted endpoints where possible. 4. Regularly rotate keys and credentials associated with Azure OpenAI services as a best practice.
Patch Details
The vulnerability was mitigated by Microsoft on their backend infrastructure on July 6, 2026. No customer action is needed to receive the patch.