Lost in Resolution: Azure OpenAI's DNS Resolution Issue
Summary: Unit 42 researchers found that Azure OpenAI's API did not enforce the unique custom domain requirement that its UI did, letting multiple tenants share the domain test.openai.azure[.]com, which resolved to 66.66.66[.]66, an IP address belonging to an external, non-Azure ISP. Microsoft deleted the DNS A record pointing to that address within days of the report, and the domain now resolves to a legitimate production API Management instance or is non-resolvable.
Why it matters: API calls, data files and API keys sent to that shared domain went to an address outside Azure's network, and a threat actor listening there could have intercepted traffic for every tenant using it - without compromising a single tenant account.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026