A significant vulnerability in Microsoft's Azure Automation service was recently uncovered, posing a risk of cross-tenant identity takeovers due to a default setting that potentially exposed account identities. Azure Automation is extensively used for DevOps, resource deployment, patching, and secrets rotation through scripted runbooks linked to embedded managed identities. This vulnerability, discovered by Shay Shavit, a senior security researcher on Microsoft's Azure Networking Security Research team, was reported to the Microsoft Security Response Center. The flaw, identified as CVE-2025-29827 with a CVSS score of 9.9, allows an attacker with access to their own Azure Automation account to breach trust boundaries and assume another tenant's automation identity. This could lead to unauthorized creation or modification of automation scripts and access to sensitive data or credentials stored in Azure Automation accounts. Despite the absence of known exploits so far, Shavit plans to demonstrate the risks associated with the default configuration at the upcoming Black Hat USA conference in Las Vegas. The default setting for Azure Automation identities has since been changed, no longer making them public. Organizations are advised to avoid exposing anything externally unless necessary and to audit the scope of identities and tokens assigned to cloud automation accounts to mitigate risks. Shavit's findings highlight how subtle misconfigurations and logic flaws can be combined to facilitate high-impact attacks. This is not the first vulnerability found in Azure Automation; previously, Orca Security discovered a flaw in 2021 that could exfiltrate managed identity tokens, known as AutoWarp. Although different in execution, both vulnerabilities aim to compromise managed identities. Shavit emphasizes the need for defenders to consider the broader picture of interconnected vulnerabilities rather than evaluating them in isolation.