EUVD-2026-41443
GHSA-f7gx-8wv8-8wm9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable service requiring valid low-privilege authorization (PR:L) and no user interaction; SSRF-to-privilege-escalation yields total confidentiality, integrity, and availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft's Azure OpenAI service allows an authorized (low-privileged) attacker to abuse a server-side request forgery flaw (CWE-918) to force the service backend to issue attacker-controlled network requests, resulting in high confidentiality, integrity, and availability impact. The flaw carries CVSS 8.8 and requires only low privileges over the network with no user interaction, but currently shows no public exploit identified at time of analysis and a modest EPSS of 0.62%. Because Azure OpenAI is a Microsoft-hosted cloud service, remediation is delivered server-side by the vendor rather than requiring customer patching.
Technical ContextAI
The vulnerability is a Server-Side Request Forgery (CWE-918), a class where an application can be coerced into making network requests to attacker-chosen destinations, typically to reach internal-only endpoints such as cloud metadata services, internal APIs, or lateral resources not exposed externally. The affected component per CPE is cpe:2.3:a:microsoft:azure_open_ai:*:*:*:*:*:*:*:* - Microsoft's managed Azure OpenAI Service, a multi-tenant PaaS offering that fronts large language models. In a cloud PaaS context, SSRF is especially impactful because the service backend often runs inside a trusted network boundary where internal metadata endpoints (e.g., IMDS) or control-plane services may be reachable, which can be leveraged to harvest credentials or tokens and thereby elevate privileges - consistent with the reported 'elevate privileges over a network' impact.
RemediationAI
Patch available per vendor advisory: Microsoft reports a fix is available and, as Azure OpenAI is a hosted service, the remediation is applied server-side by Microsoft with no customer action required to receive the fix - review the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45499 to confirm applicability. Because there is no exact customer-installable fix version (the service is versioned by the vendor), defenders cannot pin a version number. As defense-in-depth for tenants, restrict which principals hold authorization to the Azure OpenAI resource (tighten Azure RBAC to remove unnecessary low-privilege access, since exploitation requires PR:L), scope API keys and managed identities to least privilege, and monitor Azure OpenAI and control-plane activity logs for anomalous outbound or internal request patterns; the trade-off is that overly tight RBAC may disrupt legitimate integration workloads. No third-party workaround is needed since the vendor controls the runtime.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today