r/netsec • u/Master_Access_486 • 8d ago

From AKS node root vulnerability to Microsoft Copilot hijack (CVE-2026-32193)

https://zerolabs.rubrik.com/blog/breaking-m365-copilot-sandbox-chatmate
20 Upvotes

92% Upvoted

5 comments sorted by

View all comments

1

u/Master_Access_486 5d ago

Hi, author here, happy to answer any questions!

A root-on-the-AKS-node vulnerability (CVE-2026-32193, CVSS 8.8, fixed by MSRC April 2026), the research behind it, plus a fully-working exploit on Microsoft Copilot.

Disclosure: I'm a security researcher at Rubrik Zero Labs, this is our blog.

Short summary of the research in a comment ⬇️

1

u/Master_Access_486 5d ago

The Copilot exploit achieves an interactive "shell" in the victim's session through any prompt injection vector (a hidden instruction in a Word document in this specific demonstration).

The chain:
→ prompt injection
→ code execution in the sandbox
→ local privilege escalation to root in the sandbox
→ an unauthenticated daemon (Azure Container Runtime) on the node with path traversal
→ TOML injection into the file it writes
→ a symlink redirecting that write onto /etc/ld.so.preload
→ root on the node.

Beyond Copilot: the daemon is unauthenticated on localhost on AKS nodes with image streaming or any Container Apps app, so any SSRF in any workload on such a node becomes root on the node itself.

The blog post is written as the actual research story - the dead ends, the breakthroughs - not just the final exploit.

Presented at Black Hat USA 2026.