CVE-2025-30390: Azure Machine Learning Privilege Escalation

CVE-2025-30390 Overview

CVE-2025-30390 is an improper authorization vulnerability in Microsoft Azure Machine Learning. An authenticated attacker can exploit weaknesses in authorization checks to elevate privileges across the network. The flaw is tracked under CWE-285: Improper Authorization.

Microsoft published the advisory on April 30, 2025. The vulnerability affects the Azure Machine Learning service and requires low-privilege authenticated access. Successful exploitation impacts the confidentiality, integrity, and availability of the targeted workspace.

Critical Impact
An authenticated attacker with low privileges can elevate to higher privileges within an Azure Machine Learning workspace, gaining access to data, models, and compute resources owned by other tenants or users.

Affected Products

Microsoft Azure Machine Learning service
Workspaces and compute resources managed through Azure ML
Identity and role assignments scoped to Azure ML resources

Discovery Timeline

2025-04-30 - CVE-2025-30390 published to NVD
2025-05-12 - Last updated in NVD database

Technical Details for CVE-2025-30390

Vulnerability Analysis

The vulnerability stems from improper authorization checks within the Azure Machine Learning service. The service fails to correctly validate that an authenticated principal holds the required permissions before performing a privileged action. As a result, an attacker who already possesses some level of access to an Azure ML resource can perform actions reserved for users with higher roles.

The attack is network-reachable and requires no user interaction. Because Azure ML workspaces typically host training data, trained models, notebooks, and compute clusters, a successful privilege escalation exposes sensitive intellectual property and pipelines. The flaw is classified under CWE-285, indicating that authorization logic is either missing or applied inconsistently for certain operations.

Root Cause

The root cause is incomplete enforcement of role-based access control (RBAC) within Azure Machine Learning. The service evaluates authorization for certain API paths or resource operations using checks that do not fully account for the requester's effective permissions on the target object. This permits a low-privileged caller to invoke operations that should be restricted to workspace owners or contributors.

Attack Vector

The attacker first authenticates to Azure with a low-privileged account that has legitimate access to an Azure ML workspace or related resource. The attacker then issues network requests to Azure ML control-plane or data-plane endpoints that perform privileged operations. Because authorization is improperly enforced, the requests succeed and grant the attacker elevated capabilities such as reading other users' assets, modifying compute configuration, or altering pipelines.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 1.072% (77.97 percentile), indicating moderate exploit likelihood relative to the broader CVE population. For technical specifics, refer to the Microsoft CVE-2025-30390 Advisory.

Detection Methods for CVE-2025-30390

Indicators of Compromise

Azure ML control-plane API calls originating from accounts that do not normally administer the workspace
Role assignment changes, key rotations, or compute target modifications performed by low-privileged identities
Unusual access patterns to datastores, registered models, or notebooks across workspace boundaries
Sudden creation or modification of pipelines, endpoints, or compute clusters outside change windows

Detection Strategies

Ingest Azure Activity Logs and Azure ML diagnostic logs into a centralized SIEM and alert on privileged operations performed by non-administrative principals
Baseline normal Azure ML API usage per identity and flag deviations such as access to workspaces or assets the user has not previously touched
Correlate Microsoft Entra ID sign-in events with Azure ML resource operations to identify lateral movement from compromised low-privileged accounts

Monitoring Recommendations

Enable diagnostic settings on every Azure ML workspace and forward logs to Azure Monitor or an external SIEM
Monitor Microsoft.MachineLearningServices/workspaces/*/write and */action operations for unexpected callers
Review Azure RBAC role assignments on Azure ML resources weekly and alert on additions outside an approved change process

How to Mitigate CVE-2025-30390

Immediate Actions Required

Confirm that Microsoft has applied the service-side fix to all tenants by consulting the Microsoft CVE-2025-30390 Advisory
Audit existing Azure ML role assignments and remove standing privileges that are not required for daily operations
Rotate Azure ML workspace keys, service principal secrets, and managed identity credentials that may have been exposed
Review Azure Activity Logs for the past 90 days for anomalous privileged operations on Azure ML resources

Patch Information

CVE-2025-30390 affects the Microsoft-managed Azure Machine Learning service. Microsoft addresses such vulnerabilities through service-side updates that do not require customer-installed patches. Customers should verify remediation status through the Microsoft Security Response Center advisory and confirm that no manual configuration changes are required for their subscriptions.

Workarounds

Apply the principle of least privilege to all Azure ML role assignments and prefer custom roles over broad built-in roles
Enforce Conditional Access policies and multi-factor authentication for any identity with access to Azure ML workspaces
Isolate sensitive Azure ML workspaces into dedicated subscriptions or resource groups with strict RBAC boundaries
Use private endpoints and network restrictions to limit which networks can reach Azure ML control-plane and data-plane endpoints

bash

# Example: list role assignments on an Azure ML workspace and remove an unneeded assignment
az role assignment list \
  --scope "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.MachineLearningServices/workspaces/<workspace>" \
  --output table

az role assignment delete \
  --assignee <principal-id> \
  --role "Contributor" \
  --scope "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.MachineLearningServices/workspaces/<workspace>"