TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researcher Haakon Wik Gulbrandsrud reports finding five vulnerabilities in Azure API Connections that he says enabled full cross-tenant compromises of connected services. He says the findings earned $200,000 in rewards; the supplied report describes the architecture and earlier Key Vault access, but does not provide full details of all five cases or Microsoft’s response to each.
Security researcher Haakon Wik Gulbrandsrud says he found five vulnerabilities in Azure API Connections that allowed attackers to compromise connections belonging to other tenants and reach their linked services. In a report published in October 2026, he says the findings earned $200,000 in rewards; the report describes an earlier path-traversal issue that exposed a victim tenant’s Key Vault secret and says Microsoft marked that issue fixed after disclosure.
Azure API Connections are used by Logic Apps to communicate with external services. Gulbrandsrud’s account describes a shared Azure API Management layer that validates connector actions, exchanges an incoming token or key for credentials configured for the backend, and sends the request to that service. He argues that flaws in how requests identify or reach a connection can cause the shared layer to use another tenant’s credentials instead of the caller’s own.
The report says the relevant routes include ARM REST API endpoints such as DynamicInvoke and /extensions/proxy/. In the earlier exploit example included in the post, a request through the researcher’s connection used path traversal to reach a Key Vault endpoint associated with a different tenant. The response shown in the report contains a secret value and metadata. This is a researcher-published example, not independent confirmation that other tenants’ resources were accessed in the five newly described cases.
Gulbrandsrud says the vulnerabilities provided the same underlying access capabilities and could affect services including Key Vault and Azure SQL, as well as third-party backends such as Jira and Salesforce. The supplied report excerpt does not enumerate all five vulnerabilities or give details of each affected service, exploit conditions, or remediation status. The researcher also says he presented the work at Blue Hat Asia 2026 and planned to add a recording link when available.
Risk to Connected Cloud Services
The reported weakness matters because API Connections can hold or use credentials for services outside the Logic App itself. If a flaw lets a caller make the shared service act on a victim’s connection, the consequences may extend to the data and operations permitted by that connection. That could include sensitive material in Key Vault or access to an Azure SQL database, depending on the permissions configured for the backend credential.
Gulbrandsrud cautions that the severity of any compromise depends on how connection owners scope their credentials. A connection limited to a narrow set of actions would expose less than one configured with broad permissions. The report argues that input validation is a key defense but says edge cases can be difficult to cover across different connectors. These points are the researcher’s assessment; the excerpt does not establish how widely the flaws were exploitable or whether any customer data was accessed by an attacker.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Performance Keyboard – Clicky
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Jackery Explorer 1000 v2 Portable Power Station
As an affiliate, we earn on qualifying purchases.
How API Connections Route Requests
The report is part of a series in which Gulbrandsrud previously discussed Azure API Connections and an earlier full cross-tenant compromise. He says the new findings build on that work by identifying additional vulnerabilities with similar access primitives. His earlier example used an ARM request to reach a Key Vault secret through a path-traversal sequence.
According to the researcher, Microsoft marked that earlier issue fixed within weeks of disclosure. He then questioned whether the change addressed the underlying credential and connection-selection risk or mainly restricted permitted paths, and investigated the implementation further. The source excerpt cuts off during his discussion of that investigation, so it does not provide the full technical account or a complete timeline for the five findings.
“API Connections allow anyone to fully compromise any other connection worldwide, giving full access to the connected backend.”
— Haakon Wik Gulbrandsrud, security researcher
Disclosure and Fix Details
The supplied report material does not explain all five vulnerabilities in enough detail to assess their individual severity, affected connectors, or exploit requirements. It also does not say whether the other four findings were fixed, whether all fixes have been deployed, or whether Microsoft has confirmed the researcher’s account.
There is no information here about evidence of exploitation by unaffiliated attackers, the number of potentially affected customers, or whether any customer information was accessed beyond the researcher’s demonstrated example. The extent of any exposure would depend in part on the permissions and scope of the credentials used by each connection.
Further Technical and Vendor Updates
Further details depend on the full report, including the portions not present in the supplied source, and any response from Microsoft. Gulbrandsrud said he would add a link to the Blue Hat Asia 2026 talk recording once it became available. A fuller account of the fixes, affected services, and disclosure timeline would help customers determine whether their configurations require action.
Organizations using Logic Apps API Connections can review the permissions attached to their connected-service credentials and follow Microsoft’s security guidance and service updates. The report does not specify a new mitigation procedure or say that customers must take a particular immediate action.
Key Questions
What did the researcher report?
Haakon Wik Gulbrandsrud says he found five Azure API Connections vulnerabilities that could allow cross-tenant access to services linked to another tenant’s connection. The supplied report material gives a detailed example of an earlier path-traversal issue, but not full details of all five findings.
Which services could be affected?
The researcher names Key Vault and Azure SQL, along with external services such as Jira and Salesforce. The actual impact would depend on the connector and the permissions held by its configured credentials.
Did Microsoft fix the vulnerabilities?
Gulbrandsrud says an earlier reported issue was marked fixed within weeks. The supplied material does not establish the remediation status of each of the five findings or include Microsoft’s response.
Is there evidence of attacks on customer accounts?
The report includes a researcher-demonstrated example of a request returning a Key Vault secret, but the supplied material does not report unauthorized attacks by others or establish broader customer data access.
Source: binarysecurity.no
