Loading story…
Researchers disclosed two severe flaws in Azure API Connections that exposed the trust model behind Microsoft’s managed connectors and could let attackers abuse authenticated connections to reach protected backend services. In the first issue, users with only Reader access to a connection could reportedly send authenticated requests through undocumented /extensions/proxy endpoints and inherit the connection’s existing privileges, exposing data from services including Azure Key Vault, Azure SQL, Jira, Slack, Salesforce, Azure Storage, Defender ATP, and Google services. The researcher also reported that the Jira connector could be abused for SSRF and API token theft when APIToken authentication was configured.
A second report alleged that Azure’s globally shared API Management architecture for connectors enabled cross-tenant compromise through Azure Resource Manager’s undocumented DynamicInvoke endpoint. By combining a custom connector with path traversal, an attacker could reportedly make privileged requests against arbitrary victims’ API Connections and potentially control or extract data from connected backends with inherited administrator-level access. The researcher said Microsoft confirmed the issue within days, deployed mitigations within a week, and later awarded a $40,000 bounty, although the published write-up warned the fix relied largely on blocking ../ and encoded variants and might be bypassable.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
Binary Security published a detailed write-up alleging that Azure API Connections could be fully compromised across tenants via DynamicInvoke and path traversal against a globally shared APIM instance. The post said successful exploitation could expose or control connected backends including Azure Key Vault, Azure SQL, Jira, Salesforce, and Slack.
According to the researcher, MSRC confirmed the reported DynamicInvoke-based Azure API Connections vulnerability three days after submission. The flaw allegedly allowed privileged requests against other customers’ API Connections by abusing ARM request construction and path traversal.
A researcher reported a separate Azure API Connections vulnerability to MSRC involving the undocumented DynamicInvoke endpoint and path traversal through a custom connector. The issue allegedly enabled cross-tenant compromise of arbitrary victim API Connections on a shared API Management architecture.
The researcher states that Microsoft deployed mitigations within a week of the April 7 report. The implemented fix was described as a blacklist blocking ../ and some encoded variants in the attack path.
Binary Security publicly disclosed that undocumented Azure API Connections endpoints let users with Reader permissions proxy authenticated backend requests and access sensitive data. The write-up also described a Jira-specific SSRF and API token theft scenario when APIToken authentication was used.
Microsoft confirmed the Azure API Connection vulnerability that allowed Reader-level users to proxy authenticated GET requests to backend services through undocumented endpoints. The issue affected connected services such as Key Vault, SQL, Slack, Jira, Salesforce, and others.
Binary Security submitted reports to Microsoft covering the general Azure API Connections issue and a Jira-specific issue involving SSRF and API token theft. The reports described undocumented endpoints that let users abuse stored connection authentication to access backend services.
Microsoft fixed the API Connection vulnerability by restricting requests through /extensions/proxy, except for testrequests. The remediation was applied during the period from January 12 to January 17.
After the DynamicInvoke vulnerability report and mitigation, Microsoft later awarded the researcher a $40,000 bounty. The award was tied to the reported Azure API Connections cross-tenant compromise issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
binarysecurity.no
Open sourcelearn.microsoft.com
Open sourcebinarysecurity.no
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Enclave disclosed a critical improper authentication flaw in Microsoft's Azure SRE Agent that allowed an outsider with only a free Azure account to observe another organization's AI operations agent in real time. The cross-tenant exposure stemmed from a token issuance process that accepted accounts from any Microsoft cloud tenant and a communication channel that verified token validity but not tenant ownership, enabling unauthorized access to live agent sessions. Microsoft confirmed the issue, assigned `CVE-2026-32173`, rated it critical with a `CVSS` score of `8.6`, and remediated it server-side. According to the disclosure, exposed data could include user prompts, agent responses, step-by-step reasoning, executed commands, command output, and even plaintext credentials, while generating no logs visible to the victim organization, underscoring wider concerns that enterprise AI agent deployments are outpacing governance and security controls.
Jun 29, 2026
Microsoft remediated a critical Azure Automation vulnerability, tracked as **`CVE-2025-29827`** and rated **CVSS 9.9**, that could have allowed an attacker to take over another tenant’s automation identity. The issue stemmed from a public-by-default Azure Automation configuration combined with additional code flaws, creating an exploit chain that let an attacker with access to their own Azure Automation account impersonate identities across tenants and potentially reach data, credentials, scripts, and other cloud resources. Reporting on the flaw said the attack path required three weaknesses: publicly exposed Azure Automation account endpoints by default and two separate code-level bugs. Microsoft said it changed the default behavior so Azure Automation identities are no longer public by default, and no known in-the-wild exploitation has been reported. The finding echoes earlier research into Azure Automation security and underscores how cloud identity exposure and chained logic flaws can turn default service settings into high-impact cross-tenant compromise paths.
Jul 24, 2026
SentinelLabs disclosed multiple critical vulnerabilities in **Microsoft Azure Defender for IoT** that affected both cloud-connected and on-premises deployments and could allow attackers to compromise appliances without authentication. The issues included weaknesses in the password recovery workflow, such as a time-of-check/time-of-use race condition and logic flaws in certificate and subscription validation, tracked in part as `CVE-2021-42310`, which could let an attacker reset privileged passwords and take over administrative accounts. The report also detailed a command injection flaw that could lead to **root remote code execution** after account takeover (`CVE-2021-42312`), unauthenticated SQL injection bugs in token-related endpoints that could expose session IDs and enable further compromise (`CVE-2021-42313` and `CVE-2021-42311`), and a heap-based buffer overflow in the `RCDCAP` traffic-processing component (`CVE-2021-37222`). Microsoft issued security updates and advisories after responsible disclosure, and SentinelLabs said it had not observed active exploitation in the wild at the time of publication.
Aug 14, 2026