A Microsoft security researcher has revealed the full exploit chain behind CVE-2025-29827, a CVSS 9.9 vulnerability in Azure Automation that could have allowed attackers to steal managed identities across tenant boundaries.
Shay Shavit, a senior security researcher on Microsoft’s Azure Networking Security Research team, first reported the vulnerability last year. There have been no known exploits of the vulnerability in the wild.
At Black Hat 2026, Shavit shared the technical details publicly for the first time, walking through the three chained flaws that made the attack possible.
Azure Automation accounts are created with a public-facing endpoint by default. Shavit found that the service’s authorization check used the full URL, including query parameters, rather than just the path to determine whether a request required authorization.
Appending &location to any request bypassed the check entirely, giving unauthorized access to certificates, credentials, and notebook content stored in any public automation account.
To reach the managed identity, which is typically highly privileged because automation accounts need broad access across Azure resources, Shavit needed to bypass a second layer.
The service routed managed identity requests to a stricter authentication handler, but the routing logic used a case-sensitive regex match. Changing a single lowercase letter to uppercase caused the router to skip the strict handler while the downstream controller still processed the request normally.
“A capital N basically broke all of Azure’s authorization,” Shavit said. The result: any attacker with their own Azure account could query another tenant’s automation endpoint and obtain its managed identity token, gaining access to key vaults, storage accounts, and VM resources.
The vulnerability follows a similar pattern to a critical Entra ID flaw disclosed last year that allowed global admin impersonation across all tenants (CVE-2025-55241, CVSS 10.0), underscoring ongoing challenges with cross-tenant isolation in Microsoft cloud infrastructure.
Microsoft has patched all three flaws, reordered the authentication handlers, and added authorization checks at the controller level.
Azure Automation accounts are still created with public endpoints by default, but Microsoft now recommends using private networking. Shavit urged organizations to audit their automation accounts for public exposure.
