Trusted Workflow Relays:Cross-Tenant Email Abuse and Composable Red Team Initial-Access Primitives in Multi-Tenant Clouds

• URL: http://arxiv.org/abs/2608.17361v1
• Date: Tue, 18 Aug 2026 04:31:34 GMT
• Title: Trusted Workflow Relays:Cross-Tenant Email Abuse and Composable Red Team Initial-Access Primitives in Multi-Tenant Clouds
• Abstract summary: Cloud applications routinely send notifications through provider-operated mail identities.<n>An authenticated actor could reach recipients across tenant boundaries and control content that a trusted provider service delivered.<n>SPF, DKIM, and DMARC can authenticate a message yet cannot establish that an application-level send was authorized.
• Score: 0.0
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Cloud applications routinely send notifications through provider-operated mail identities, which improves deliverability but separates the actor who supplies notification parameters from the service principal that originates the message. In three responsibly disclosed and remediated cross-tenant notification workflows, an authenticated actor could reach recipients across tenant boundaries and, to varying degrees, control content that a trusted provider service delivered. In the first, backend requests bypassed a UI length limit, raw HTML and CSS survived into the delivered message, attacker links rendered, and CSS could hide service-controlled text; iframes and non-web URI schemes were rejected. The second combined missing recipient-tenant validation with attacker-controlled subject and HTML fields. The third, an approval application, added weak access control, sequential object identifiers, missing action authorization, and incomplete token validation, composing notification abuse with authorization failures. The pattern is analogous to a classical unauthenticated SMTP open relay, but the failure has moved up the stack: the actor is authenticated and the provider is the legitimate sender, yet application-layer authorization still fails to constrain who may cause it to send what to whom. We define a trusted workflow relay as a delivered, service-authentic message for which the application-level send-authorization predicate is false. We give a test matrix for notification pipelines, map the primitive to MITRE ATT&CK techniques for attachment-free phishing, and link it to device-code phishing (RFC 8628). SPF, DKIM, and DMARC can authenticate a message yet cannot establish that an application-level send was authorized. We conclude with controls for tenant binding, typed templates, object-level authorization, token audience validation, and identity telemetry.

Related papers

• From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents [5.02192791020171]
  KITA is a review-to-authorization architecture that keeps the user's secret signing key.<n>We implement the complete reviewer-to-executor path with a structured-output LLM adapter.
  arXiv  Detail & Related papers  (2026-09-05T05:53:51Z)
• ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use [29.860376266824872]
  OAuth authorization alone does not ensure that a later tool call is executed by the provider-side workload that the relying party intended to trust.<n>We present ACLE-MCP, an invocation-scoped architecture that couples delegated authorization, workload appraisal, and resource-side execution admission.
  arXiv  Detail & Related papers  (2026-09-02T14:58:17Z)
• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection [61.4148196085256]
  We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust.<n>Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision.
  arXiv  Detail & Related papers  (2026-08-27T01:22:14Z)
• KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation [53.952294884822955]
  Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials.<n>We present KeyPooling, a measurement method that traces customer identity through cache lookup and write.<n>We derive a defense contract: every customer must enter a provider-enforced domain.
  arXiv  Detail & Related papers  (2026-08-18T08:12:34Z)
• Agent Security Needs Redefinition through a Holistic Framework [46.88917910966891]
  Defenses ask whether an instruction looks malicious. Benchmarks ask whether an agent performs a harmful sounding action.<n>We operationalize contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory.
  arXiv  Detail & Related papers  (2026-07-24T06:43:09Z)
• AuthProbe: Specification-Driven, Multi-Identity Detection of Broken Object-Level Authorization in Recruitment API [0.0]
  Broken Object-Level Authorization (BOLA) has topped the API Security ranking since 2019.<n>We present AuthProbe, an open-source, black-box scanner that detects BOLA and IDOR in HTTP APIs.<n>AuthProbe is released under the Apache 2.0 license with an authorized-use guardrail.
  arXiv  Detail & Related papers  (2026-07-22T03:04:04Z)
• Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing [75.56230265544042]
  Large-scale text-to-image (T2I) diffusion models have enabled unprecedented creative applications, but their unauthorized use has raised serious intellectual property concerns.<n>We propose Cert-LAS, the first certified MOV method for T2I models based on layer-adaptive smoothing.<n>Under certain conditions, our Cert-LAS can still achieve reliable verification even in the presence of malicious removal attacks.
  arXiv  Detail & Related papers  (2026-05-28T11:54:52Z)
• Good Agentic Friends Do Not Just Give Verbal Advice: They Can Update Your Weights [58.27172968382275]
  Multi-agent LLM systems usually collaborate by exchanging natural-language messages.<n>We study an alternative communication interface: instead of appending a sender's message to the receiver's context, compile the sender's hidden states into a transient, receiver-specific weight perturbation.
  arXiv  Detail & Related papers  (2026-05-13T17:58:32Z)
• An Analysis of Attack Vectors Against FIDO2 Authentication [45.88028371034407]
  This paper examines passkeys, also known as FIDO2, which claim to provide phishing-resistant authentication.<n>A private key is stored on a user's device, the authenticator, while the server stores the corresponding public key.<n>During authentication, the server generates a challenge that the user signs with the private key; the server then verifies the signature and establishes a session.
  arXiv  Detail & Related papers  (2026-04-22T17:52:56Z)
• Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents [0.6747475365990533]
  In agentic settings reasoning, prompt injection, or multi-agent orchestration can silently expand privileges.<n>We introduce Agentic JWT (A-JWT), a dual-faceted intent token that binds each agent's action to verifiable user intent.<n>A-JWT carries an agent's identity as a one-way hash derived from its prompt, tools and configuration.
  arXiv  Detail & Related papers  (2025-09-16T23:43:24Z)
• Per-sender neural network classifiers for email authorship validation [0.0]
  Business email compromise and lateral spear phishing attacks are among modern organizations' most costly and damaging threats.<n>Authorship validation is a lightweight, real-time defense that complements traditional detection methods by modeling per-sender writing style.<n>The paper evaluates two classifiers -- a Naive Bayes model and a character-level convolutional neural network (Char-CNN) -- for the authorship validation task.
  arXiv  Detail & Related papers  (2025-08-09T17:58:16Z)
• Accountable, Scalable and DoS-resilient Secure Vehicular Communication [0.27624021966289597]
  broadcasted Cooperative Awareness Messages (CAMs) and Decentralized Environmental Notification Messages (DENMs) are pseudonymous authenticated for security and privacy protection.<n>This creates an asymmetry that can be easily exploited by external adversaries to launch a clogging Denial of Service (DoS) attack.<n>We propose efficient cryptographic constructs, which we term message verification facilitators, to prioritize processing resources for verification of potentially valid messages.
  arXiv  Detail & Related papers  (2025-05-28T09:25:34Z)
• CTRAPS: CTAP Client Impersonation and API Confusion on FIDO2 [2.949446809950691]
  We focus on CTAP, which allows FIDO2 clients and hardware authenticators to communicate.<n>We uncover two classes of protocol-level attacks on CTAP that we call CTRAPS.<n>We detail the eight vulnerabilities in the CTAP specification, enabling the CTRAPS attacks.<n>We release CTRAPS, an original toolkit, to analyze CTAP and conduct the CTRAPS attacks.
  arXiv  Detail & Related papers  (2024-12-03T10:11:41Z)
• Robust and Verifiable Information Embedding Attacks to Deep Neural Networks via Error-Correcting Codes [81.85509264573948]
  In the era of deep learning, a user often leverages a third-party machine learning tool to train a deep neural network (DNN) classifier. In an information embedding attack, an attacker is the provider of a malicious third-party machine learning tool. In this work, we aim to design information embedding attacks that are verifiable and robust against popular post-processing methods.
  arXiv  Detail & Related papers  (2020-10-26T17:42:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.