Executive brief
Azure SQL Database is Microsoft's managed relational database service used by enterprises to store and manage critical business data. A server-side request forgery vulnerability allows attackers to make unauthorized requests from the database server itself, potentially gaining administrative access to the database and other backend systems without proper authentication.
Technical details
A server-side request forgery (SSRF) vulnerability exists in Azure SQL Database that allows an unauthenticated attacker to make arbitrary network requests from the database server context. The vulnerability permits privilege escalation, giving attackers the ability to access resources and backend systems that should be restricted. The attack is network-reachable and requires no authentication or user interaction. Patches are expected from Microsoft via their security update channels.
Affected products
- Microsoft Azure SQL Database
Timeline
- 2026-08-21: disclosed