← Back to feed
2026-09-12 LLMjackingPrompt Injection TLP:CLEAR

CVE-2026-45499: Azure OpenAI Service SSRF Enables Privilege Escalation and AI Model Abuse via LLM-Assisted Exploitation

Date: 2026-09-12
Tags: llmjacking, cloud-abuse, prompt-injection

Executive Summary

Azure OpenAI SSRF (CVE-2026-45499) allows privilege escalation. Priority areas include emergency patching and segmentation for Azure OpenAI to prevent privilege escalation and lateral movement. An SSRF vulnerability in Azure OpenAI Service exposes cloud credentials and enables pivot to internal resource management APIs, directly supporting LLMjacking campaigns where attackers use compromised AI service credentials to access additional cloud services or subsidize malicious inference workloads.

Campaign Summary

FieldDetail
Campaign / MalwareCVE-2026-45499 Azure OpenAI SSRF Exploitation
AttributionUnknown (likely opportunistic and targeted) (confidence: low)
TargetAzure OpenAI Service deployments and downstream cloud resources
VectorServer-side request forgery to Azure metadata service and internal APIs
Statusactive
First Observed2026-09-01

Detailed Findings

Today's top risks include acceleration of OT exploit porting via AI tools and an urgent Azure OpenAI privilege escalation vulnerability. Accelerated portability of OT exploits via AI demands rapid inventory and remediation of all exposed OT and cloud AI surfaces. The vulnerability allows an attacker with access to an Azure OpenAI deployment to issue SSRF requests via model inference calls, reaching the Azure Instance Metadata Service (IMDS) and retrieving managed identity tokens. These tokens provide access to Key Vault, storage accounts, and resource group management, enabling lateral movement and credential harvesting. When combined with LLMjacking workflows, the flaw creates a compounding risk: an attacker who gains initial access via exposed API keys can use SSRF to escalate to subscription-level credentials, enabling control over multiple AI services and cloud infrastructure.

MITRE ATT&CK Mapping

TechniqueIDContext
Server-Side Request ForgeryT1918SSRF via LLM inference calls to reach Azure IMDS and retrieve credentials
Privilege EscalationT1134Use of compromised managed identity tokens to access higher-privilege Azure resources

IOCs

Domains

_CVE-2026-45499 tracking identifier; exploit pattern involves SSRF via model API calls_

Full URL Paths

_CVE-2026-45499 tracking identifier; exploit pattern involves SSRF via model API calls_

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

Azure OpenAI Service (all inference models)
Azure Instance Metadata Service

Detection Recommendations

Monitor Azure OpenAI API call logs for suspicious inference patterns, particularly requests with payloads targeting internal IP ranges (169.254.169.254 IMDS, internal service endpoints). Alert on managed identity token retrieval or Key Vault access initiated from Azure OpenAI runtime contexts. Implement network policies restricting Azure OpenAI service managed identities to necessary resources only. Enforce conditional access policies requiring MFA for subscription-level role assignments. Segment Azure OpenAI deployments behind network policies that block IMDS and internal API access. Audit API key rotation and restrict key scope to specific models and operations. Use Azure Policy to enforce network-level isolation of AI service deployments.

References