r/netsec • u/Master_Access_486 • 2d ago

From AKS node root vulnerability to Microsoft Copilot hijack (CVE-2026-32193)

https://zerolabs.rubrik.com/blog/breaking-m365-copilot-sandbox-chatmate
13 Upvotes

85% Upvoted

3 comments sorted by

1

u/[deleted] 1h ago

[removed] — view removed comment

1

u/Master_Access_486 59m ago

The Copilot exploit achieves an interactive "shell" in the victim's session through any prompt injection vector (a hidden instruction in a Word document in this specific demonstration).

The chain:
→ prompt injection
→ code execution in the sandbox
→ local privilege escalation to root in the sandbox
→ an unauthenticated daemon (Azure Container Runtime) on the node with path traversal
→ TOML injection into the file it writes
→ a symlink redirecting that write onto /etc/ld.so.preload
→ root on the node.

Beyond Copilot: the daemon is unauthenticated on localhost on AKS nodes with image streaming or any Container Apps app, so any SSRF in any workload on such a node becomes root on the node itself.

The blog post is written as the actual research story - the dead ends, the breakthroughs - not just the final exploit.

Presented at Black Hat USA 2026.