CVE-2026-45499: Azure OpenAI Elevation of Privilege Vulnerability

Synopsis

A server-side request forgery (SSRF) vulnerability exists in Azure OpenAI that allows an attacker with any valid account to make the service issue unauthorized requests on their behalf, effectively pivoting to internal resources. The vulnerability is reachable over the network and requires only low-privilege credentials, with no victim interaction needed. Successful exploitation grants full control over confidentiality, integrity, and availability in a scope that extends beyond the directly vulnerable component. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Microsoft publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Azure OpenAI service endpoint over the network; the attack vector is fully remote with no physical or local access required.

• AuthenticationRequired

  The attacker must hold at least one low-privilege account; any valid credential is sufficient, but unauthenticated access alone is not enough.

• Victim interactionNot required

  No user action, click, or social-engineering step is needed; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable with no race conditions, special memory layouts, or environmental prerequisites required.

Blast Radius

• Reads internal service responses and metadata that the Azure OpenAI endpoint can reach, including resources that would otherwise be inaccessible to the attacker's account.
• Modifies data or configuration in backend systems reachable via the forged server-side requests, extending write impact beyond the attacker's normal privilege boundary.
• Disrupts availability of internal services targeted by the SSRF chain, crashing or exhausting resources in components that were never intended to accept external input.
• The Changed scope means impact extends to systems and tenants outside the directly vulnerable Azure OpenAI component, amplifying the blast radius beyond a single service boundary.