Azure Automation Flaw Enabled Cross-Tenant Identity Takeover

A critical vulnerability in Microsoft Azure Automation could have allowed attackers to hijack managed identities across tenant boundaries, potentially granting full control over cloud resources and sensitive credentials.

Shay Shavit, a senior security researcher on Microsoft's Azure Networking Security Research team, discovered the flaw last year and reported it to the Microsoft Security Response Center. The vulnerability, tracked as CVE-2025-29827 with a CVSS score of 9.9, stemmed from a default configuration that made Azure Automation account endpoints publicly accessible.

Azure Automation is a core service used by Microsoft and enterprises for DevOps workflows, resource deployment, system patching, and secrets rotation. The service relies on scripted runbooks tied to managed identities — privileged accounts that authenticate cloud operations without storing credentials.

The attack chain

Shavit's exploit chained three distinct weaknesses: the default public configuration plus two separate code-level bugs. An attacker with their own Azure Automation account could breach the trust boundary and assume another tenant's automation identity, effectively bypassing isolation controls designed to keep customer environments separate.

Once an identity is compromised, the attacker gains extensive privileges. "It's the endgame, because if you have a strong enough identity, you're the king in the world," Shavit explained. "You don't really need to continue your exploitation; you can do whatever you want, either in the portal, in the CLI [or] in the APIs."

A successful exploit would enable attackers to create or modify automation scripts, access configuration data and credentials, and manipulate resources across an organization's cloud infrastructure.

Why it matters

This vulnerability highlights how default configurations in cloud services can create systemic risk at scale. When a service defaults to public access, every account inherits that exposure until manually reconfigured — a pattern that affects not just individual organizations but entire platforms. For security teams, the finding reinforces that cloud identity compromise represents a critical attack path, often more valuable to adversaries than traditional network exploitation. The chaining of multiple low-severity issues into a high-impact attack also challenges conventional risk assessment approaches that evaluate vulnerabilities in isolation.

Current status and recommendations

Microsoft has changed the default setting so Azure Automation identities are no longer public. Shavit reports no known exploitation in the wild, though he plans to demonstrate the attack technique at Black Hat USA next month.

Organizations should audit their Azure Automation configurations to ensure endpoints aren't unnecessarily exposed. Shavit recommends avoiding external exposure unless specifically required and regularly auditing the scope of identities and tokens assigned to cloud automation accounts.

This isn't the first identity-related vulnerability in Azure Automation. In 2021, Orca Security discovered AutoWarp, a flaw that could exfiltrate managed identity tokens from shared sandbox servers. While both vulnerabilities targeted managed identities, the attack chains differed — AutoWarp exploited code execution components, while Shavit's discovery bypassed that layer entirely.

Shavit urges defenders to think beyond individual vulnerabilities. "Think about the chain — think about the attack path," he said, noting that multiple low-severity bugs can combine to create critical exposure.

These details were first reported by Dark Reading.