Azure Automation Flaw Allowed Cross-Tenant Identity Takeover

A significant security flaw in Microsoft's Azure Automation service, identified as CVE-2025-29827, presented a risk of cross-tenant identity takeovers due to a default configuration that inadvertently exposed account identities. Azure Automation is a widely utilized service for tasks such as DevOps, resource deployment, patching, and secrets management, relying on scripted runbooks that are tied to embedded managed identities. The vulnerability, discovered by Shay Shavit, a senior security researcher on Microsoft's Azure Networking Security Research team, was reported to Microsoft's Security Response Center (MSRC).

The vulnerability, which received a CVSS score of 9.9, allowed an attacker with access to their own Azure Automation account to breach the trust boundary and assume another tenant's automation identity. This would grant them the ability to create or modify automation scripts, access sensitive configuration data or credentials stored within Azure Automation accounts, and potentially create, change, or delete resources across an organization's cloud workloads. Shavit plans to demonstrate the exploit at the upcoming Black Hat USA conference.

According to Shavit, there have been no known instances of this vulnerability being exploited in the wild. However, he highlighted that the default configuration at the time of discovery made the endpoint of Azure Automation accounts public, which was the key to exploiting the flaw and accessing multiple accounts. Microsoft has since addressed this issue by changing the default setting, ensuring that Azure Automation identities are no longer publicly accessible by default.

Shavit explained that his team targeted Azure Automation because its accounts often hold privileged identities, making them a high-value target. By breaching the trust boundary between the service and these identities, an attacker could gain extensive control, effectively becoming a 'king' within the compromised environment. This level of access would allow them to perform virtually any action through the Azure portal, CLI, or APIs without needing further exploitation.

While the default configuration has been rectified, Shavit advises organizations to limit the external surfacing of any cloud service components unless absolutely necessary. He also recommends that companies regularly audit the scope of identities and tokens assigned to their cloud automation accounts to mitigate risks. This vulnerability serves as a prime example of how seemingly minor misconfigurations and logic flaws can be chained together to enable high-impact attacks.

The exploit chain that Shavit developed consisted of three distinct flaws: the default public accessibility of Azure Automation accounts, coupled with two separate code-level bugs. This finding is not the first security issue identified in Azure Automation. In 2021, researchers from Orca Security discovered a similar vulnerability, dubbed AutoWarp, which could exfiltrate managed identity tokens from a shared server. Although AutoWarp was deemed critical, it did not receive a CVE identifier.

Shavit emphasized that while both vulnerabilities aimed to extract a victim's managed identity, their attack vectors differed. AutoWarp relied on code execution to establish a reverse shell, whereas his discovery did not involve code execution. Regardless of the specific technical details, Shavit believes these findings underscore a critical shift in cloud security risks, where identities have become a central focal point for attackers.

For security defenders, Shavit advocates for a holistic approach to vulnerability assessment, urging them to map potential attack paths that connect multiple weaknesses rather than evaluating individual flaws in isolation. He stresses the importance of considering how seemingly low-severity bugs can pose significant risks when combined.