Azure's Weakest Link – Five Full Cross-Tenant Compromises
swq115
291 points
56 comments
October 30, 2026
Related Discussions
Found 5 related stories in 131.4ms across 11,107 title embeddings via pgvector HNSW
- Sandbox Escape Vulnerabilities Across 4 Coding Agent Vendors fogeltine · 11 pts · July 20, 2026 · 54% similar
- Forging a Microsoft Edge Full Chain with Logic Bugs Only austinallegro · 237 pts · October 29, 2026 · 51% similar
- How Microsoft's "Little Workaround" Created a Major Pentagon Threat amai · 11 pts · July 21, 2026 · 48% similar
- Build your own vulnerability harness ianrahman · 32 pts · July 10, 2026 · 48% similar
- TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access jervant · 101 pts · July 15, 2026 · 48% similar
Discussion Highlights (9 comments)
thewisenerd
path traversal and IDOR.. likely been active since the inception of these capabilities wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)
meekins
When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
xmcp123
God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level. Should have been addressed in the Geneva conventions.
albert_e
maybe we should tag submissions with dates now? [2026-10-02] beginning of curent month feels like two years ago when multiple vulns drop daily
eugenekay
Reporting cross-Tenant issues as an outsider with a vulnerability chain gets you $$$. Reporting “theoretical” issues with validation as an Employee gets you a lot of questions as to why you were looking. Oh well.
outworlder
Ok so. Microsoft had an egregious cross-tenant vulnerability (really, how many cross-tenant vulnerabilities did other clouds have?). Vulnerability was reported. They fixed it - incorrectly. Reported again. They fixed it this time... and broke the previous fix. So it's vulnerable again. What a clown show.
unddoch
If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent? The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists.
giovanni_or2
This guy must be the nightmare of Azure developers, kudos for the incredible work on finding these vulnerabilities!
mapotofu
“Go to the cloud!”, they said. The cloud: Let’s see how their platform design holds up in the coming years, and if it can hold up to LLMs doing more of this same type of discovery and whether MSFT can fix it.