Azure's Weakest Link – Five Full Cross-Tenant Compromises

 (binarysecurity.no)

91 points | by swq115 3 hours ago

4 comments

  • albert_e 5 minutes ago
    maybe we should tag submissions with dates now?

    [2026-10-02]

    beginning of curent month feels like two years ago when multiple vulns drop daily

  • meekins 9 minutes ago
    When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
    [-]
    • xmcp123 4 minutes ago
      Same reason as it was in 2002. “No one ever got fired for buying Microsoft.”
  • thewisenerd 45 minutes ago
    path traversal and IDOR..

    likely been active since the inception of these capabilities

    wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)

    [-]
    • chinathrow 12 minutes ago
      Gotta put these backdoors somewhere.
  • xmcp123 8 minutes ago
    God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.

    Should have been addressed in the Geneva conventions.