GoKawiilSecurity researcher finds five cross-tenant flaws in Azure API Connections, earns $200,000 bounty
A researcher detailed five new vulnerabilities in Azure Logic Apps' API Connections feature that allowed full cross-tenant compromise, letting an attacker access another tenant's connected backends such as Key Vaults, Azure SQL databases, Jira, or Salesforce. The researcher says Microsoft paid a combined $200,000 bounty for the findings, following earlier disclosures in the same series about this architecture. The researcher plans to detail the work further in a talk at Blue Hat Asia 2026.
GoKawiil's interpretation of the reporting above, not reported fact.
The repeated discovery of similar cross-tenant flaws suggests the underlying API Connections architecture may have systemic weaknesses that are hard to fully patch through input validation alone, according to the researcher. Because API Connections link to widely used third-party services and sensitive stores like Key Vault and SQL databases, successful exploitation could expose data across unrelated Azure customers, raising broader questions about isolation guarantees in multi-tenant cloud platforms.
- Researcher disclosed five new vulnerabilities enabling full cross-tenant compromise via Azure API Connections.
- Microsoft reportedly paid $200,000 in bounties for these findings as part of an ongoing research series.
- Flaws could expose connected backends including Key Vaults, Azure SQL, Jira, and Salesforce across tenant boundaries.
Source: binarysecurity.no — Haakon Wik Gulbrandsrud, 2026-10-30
Published there as: “Azure's Weakest Link – Five Full Cross-Tenant Compromises”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.