Azure API Connections Enable Full Cross‑Tenant Compromise, Research Shows

Azure’s API Connections, a core component of Logic Apps, can be abused to hijack any backend service in any tenant, giving attackers unrestricted access to resources such as Key Vaults and Azure SQL databases, according to a detailed post by Haakon Wik Gulbrandsrud on October 2 2026.

What vulnerability was discovered in Azure API Connections?

The researcher identified a series of flaws in the way API Connections interact with Azure API Management (APIM) and the Azure Resource Manager (ARM) REST API. By leveraging the undocumented DynamicInvoke, DynamicList, and two other dynamic endpoints, an attacker can craft requests that traverse internal paths and force APIM to use a token belonging to a victim’s connection. The core issue is that ARM, which has broad resource access, can invoke these endpoints without proper validation of the target connection, effectively bypassing tenant isolation.

How does the exploit achieve cross‑tenant access?

The attack chain starts with a Logic App workflow that calls a shared APIM instance. Normally APIM validates the swagger definition of the connector and swaps the caller’s token for the backend token configured in the connection. By sending a specially‑crafted request to the ARM DynamicInvoke endpoint—e.g., a path containing %2e%2e/ sequences—the attacker tricks APIM into addressing a different connection’s backend. Because the backend token is attached to the request, the attacker gains the same privileges the victim connection had, whether that token is an OAuth bearer token or an API key.

A concrete payload posted by Gulbrandsrud reads a secret from a victim’s Key Vault using a path‑traversal request:

POST /subscriptions/.../providers/Microsoft.Web/connections/custom2/DynamicInvoke?api-version=2018-07-01-preview HTTP/2
Host: management.azure.com
Authorization: Bearer 
Content-Type: application/json

{
  "request": {
    "method": "get",
    "path": "path/%2e%2e/%2e%2e/%2e%2e/%2e%2e/apim/keyvault/fd8d0f4f4069495991ccb4974f96a1ed/secrets/victimsecret/value"
  }
}

The response returns the secret value, proving that the attacker can read any Key Vault secret reachable through a compromised connection.

Which services can be compromised through the flaw?

Because API Connections are a generic bridge to “externally connected services,” the attack surface is effectively unbounded. Gulbrandsrud demonstrated:

• Azure Key Vault – reading any secret stored in a victim’s vault.
• Azure SQL Database – executing arbitrary SQL statements, such as inserting rows into a table, via the DynamicList endpoint.
• Third‑party SaaS APIs – any service linked through a connector (e.g., Jira, Salesforce) can be accessed with the victim’s credentials.

The common denominator is that the backend token is reused verbatim, so any service that trusts that token is compromised.

What fixes has Microsoft applied and what remains risky?

After the initial disclosure, Microsoft released a patch that blocks the specific path patterns used in the DynamicInvoke exploit. However, the fix only added a blacklist for certain URL segments; it did not address the underlying token‑reuse issue. When Gulbrandsrud tested again, the request returned an error about an invalid host API runtime URL, indicating that the new validation stopped the exact payload he used.

Unfortunately, the same dynamic endpoints (DynamicList, DynamicDelete, DynamicPatch) remained reachable, and the patch simply blocked them outright. No deeper mitigation—such as verifying ownership of the target connection before token reuse—was introduced. Gulbrandsrud warned that if Microsoft ever re‑exposes these endpoints, the same traversal logic could be exploited again.

How can Grafy users investigate or protect against similar issues?

While Grafy does not provide a built‑in Azure security scanner, creators and developers can use the platform to audit code and documentation related to Azure Logic Apps:

• Grafy Code – Load your ARM templates or Logic App definitions into the /code studio and run static analysis or custom linting scripts that flag usage of undocumented Dynamic endpoints.
• Grafy Reader – Upload Microsoft’s API Connection documentation PDFs to the /reader app and ask the AI to summarize any sections that discuss token handling or validation, helping you spot missing checks.
• Grafy Chat – Prompt the multi‑model chat to explain the exploit flow in plain language or to generate remediation guidelines for your own tenant.

By combining these tools, teams can surface risky patterns before they reach production and maintain an audit trail of the investigations.

Frequently asked questions

How does the DynamicInvoke endpoint bypass tenant isolation?

DynamicInvoke accepts a raw path that the caller can manipulate. Because ARM forwards the request to APIM without confirming that the target connection belongs to the caller, the attacker can insert ../ segments to reach a different connection’s backend token, effectively stepping outside the tenant boundary.

Does Microsoft’s recent patch fully close the vulnerability?

The patch blocks the exact traversal pattern used in the original DynamicInvoke exploit and disables the DynamicList, DynamicDelete, and DynamicPatch endpoints. However, the core design flaw—reusing a victim’s token without ownership verification—remains unaddressed, leaving the door open for future abuse if the endpoints are re‑enabled.

What immediate steps should Azure customers take?

Customers should audit all API Connections for overly permissive tokens, switch to scoped OAuth permissions where possible, and consider moving critical workloads to Standard Logic Apps where managed identities can be tightly controlled. Additionally, monitor for unexpected calls to the APIM management endpoint.

---

Source: https://www.binarysecurity.no/posts/2026/10/one-root-case

---

Source: Hacker News — front page — Azure's Weakest Link – Five Full Cross-Tenant Compromises