Skip to content

Azure Blob Storage

181 indexed

Azure Blob Storage exposes data when a container's "Public access level" is set to `blob` (anonymous read of individual blobs) or `container` (anonymous read plus enumerate). The latter is the more dangerous default.

Azure Blob Storage exposure data

181
Total tracked
181
Currently open
2026-08-12: 1872026-09-05: 181

Aggregate figures only. See the full open-buckets data across all providers.

Common misconfiguration class

Azure's container-level toggle predates the account-wide "allow blob anonymous access" switch (rolled out 2022). Storage accounts created before that point default to allowing anonymous access, a setting that has to be explicitly disabled even if no container uses it.

Real-world impact

Container-level anonymous access returns a full XML list of blobs at `https://<account>.blob.core.windows.net/<container>?restype=container&comp=list`. Each blob is then individually downloadable.

Remediation

  • Disable "Allow Blob anonymous access" at the storage-account level.
  • Set every container's public access level to `Private` unless it's a CDN origin.
  • Use SAS tokens for time-bounded sharing instead of permanent anonymous reads.

URL patterns

Azure Blob Storage buckets typically resolve under hostnames like:

  • example.blob.core.windows.net/container/
  • example.blob.core.windows.net/container?restype=container&comp=list

Check a specific Azure Blob Storage URL

Paste any Azure Blob Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.

Open the Viewer

Own a listed Azure Blob Storage bucket?

If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.

Submit takedown request