Default Azure Automation Setting Enables Cross-Tenant Identity Takeover

A critical vulnerability in Microsoft's Azure Automation service could have exposed accounts to cross-tenant identity takeovers due to a default setting that had the potential to make account identities become public. Azure Automation is widely used by Microsoft internally and by enterprises running Azure for DevOps, resource deployment, patching, and secrets rotation using scripted runbooks tied to embedded managed identities. Shay Shavit, a senior security researcher on Microsoft's Azure Networking Security Research team, discovered the vulnerability last year and reported it to the Microsoft Security Response Center (MSRC), which issued an advisory. Azure Automation Elevation of Privilege Vulnerability (CVE-2025-29827), which was assigned a CVSS score of 9.9, allows an attacker with access to their own Azure Automation account to breach the trust boundary and assume another tenant's automation identity. This would enable them to create or modify automation scripts and access sensitive configuration data or credentials stored in Azure Automation accounts. A successful attacker could also create, change, or delete resources across an organization's cloud workloads. Shavit tells Dark Reading that there have been no known exploits of the vulnerability, but in his demonstration at next month's Black Hat USA conference in Las Vegas, he plans to show how the default configuration poses a risk to Microsoft and its customers. The default setting for Azure Automation identities is n...