{"slug": "cve-2026-32193-is-a-copilot-hijack-disguised-as-a-boring-path-traversal", "title": "CVE-2026-32193 Is a Copilot Hijack Disguised as a Boring Path Traversal", "summary": "Researchers have detailed a path traversal vulnerability in Azure Kubernetes Service (CVE-2026-32193) that can be chained into a container-to-host escape and potentially a Microsoft Copilot hijack. The flaw, fixed in node image build v0.20260213.5, allows an authenticated attacker with pod access to gain root on a managed node, exposing kubelet credentials and cloud identity material. The researchers emphasize that the scope change in the CVSS vector enables the escape, and they warn that assistant identities with broad API permissions act as privilege concentrators, making such attacks generalizable beyond this CVE.", "body_md": "The official record is one sentence: an \"authorized attacker,\" a local path traversal in Azure Kubernetes Service, 8.8 CVSS. The researchers who found the bug headlined it differently: \"From AKS node root vulnerability to Microsoft Copilot hijack.\" Same vulnerability. The distance between those two descriptions is the story, and the aggregators missed it.\n\nContext matters here. June 2026 brought a 206-vulnerability Patch Tuesday with three disclosed zero-days, the largest on record. A \"local\" traversal with an EPSS of 0.00336 sinks in that noise. The two most visible public writeups are openly machine-generated, and one claims no vendor fix exists in the same entry that recommends the Microsoft update. The actual chain never got told.\n\nThe flaw is CWE-22 in AKS file path handling: input is not canonicalized against a restricted base directory, so ../ sequences and absolute paths escape the intended root. The fixed line is node image build v0.20260213.5, delivered through the AKS update channel. Both facts point at Microsoft-built node-side components, not upstream Kubernetes.\n\nThe load-bearing character in the CVSS vector is S:C, scope changed. The traversal is the lockpick. The scope change is the container-to-host escape. Root on a managed node hands you the kubelet's credentials, every projected service account token on the box, the runtime socket, and whatever cloud identity material the node can fetch.\n\nWorth noting: Microsoft's own title says \"Remote Code Execution\" while the vector says AV:L and cvefeed flatly states \"Remotely Exploit: No.\" My read: \"local\" is measured from the node. An authenticated tenant running code in their own pod already holds that position. That's a normal Tuesday with a working deployment, not a high bar.\n\nStage four, the Copilot hop, is public only as a title, and I'm flagging that instead of pretending otherwise. The shape of this attack class is standard, though. Assistants wired into control planes act through identities holding API permissions, usually broad ones, because the product promise is that the assistant does things for you. From a compromised node, the attacker shops for whatever identity material the node can reach. If any of it can call APIs the assistant trusts or touch resources the assistant operates on, node root stops being a node problem.\n\nAn assistant with cloud API permissions is a privilege concentrator by design: one identity with standing permissions, acting for many users. Its activity blends into legitimate automation, so audit entries look normal until someone asks why it was enumerating node credentials at 3 a.m.\n\nThe attacker doesn't need a vulnerability in the assistant. They need to reach something the assistant trusts. A node-side escape plus an over-scoped identity is exactly that, and it generalizes well past this one CVE. Model assistant identities like tier-0 accounts, because that's what they are.\n\nPatch every pool past the fixed build, then verify each pool's reported image version. Don't assume the system pool's fix propagated.\n\n```\naz aks nodepool upgrade --resource-group <rg> --cluster-name <cluster> \\\n  --name <pool> --node-image-only\n```\n\nThen find which service accounts are federated to Azure identities:\n\n```\nkubectl get serviceaccounts -A -o json | \\\n  jq -r '.items[] |\n         select(.metadata.annotations[\"azure.workload.identity/client-id\"] != null) |\n         \"\\(.metadata.namespace)/\\(.metadata.name)\"'\n```\n\nFor every hit, pull the Azure role assignments on the backing identity and cut anything it can't justify.\n\nTakeaways for today:", "url": "https://wpnews.pro/news/cve-2026-32193-is-a-copilot-hijack-disguised-as-a-boring-path-traversal", "canonical_source": "https://dev.to/secbyjasonmiller/cve-2026-32193-is-a-copilot-hijack-disguised-as-a-boring-path-traversal-6nf", "published_at": "2026-09-01 20:50:14+00:00", "updated_at": "2026-09-01 21:24:18.436737+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-policy", "ai-infrastructure", "ai-agents"], "entities": ["Microsoft", "Azure Kubernetes Service", "Copilot", "CVE-2026-32193"], "alternates": {"html": "https://wpnews.pro/news/cve-2026-32193-is-a-copilot-hijack-disguised-as-a-boring-path-traversal", "markdown": "https://wpnews.pro/news/cve-2026-32193-is-a-copilot-hijack-disguised-as-a-boring-path-traversal.md", "text": "https://wpnews.pro/news/cve-2026-32193-is-a-copilot-hijack-disguised-as-a-boring-path-traversal.txt", "jsonld": "https://wpnews.pro/news/cve-2026-32193-is-a-copilot-hijack-disguised-as-a-boring-path-traversal.jsonld"}}