CVE-2026-32193 Is a Copilot Hijack Disguised as a Boring Path Traversal

CVE-2026-32193 is a Microsoft Copilot hijack disguised as a seemingly mundane local path traversal vulnerability in Azure Kubernetes Service (AKS). Researchers labeled it as a journey from AKS node root vulnerability to Microsoft Copilot hijack, highlighting the significance of the vulnerability. In June 2026, a Patch Tuesday release included three disclosed zero-days, making the local traversal vulnerability stand out with an EPSS of 0.00336.

The flaw exists in AKS file path handling, where input is not canonicalized against a restricted base directory. This allows ../ sequences and absolute paths to escape the intended root, leading to a scope change and ultimately a container-to-host escape. Once an attacker gains root access on a managed node, they can obtain the kubelet's credentials, all projected service account tokens on the box, the runtime socket, and any cloud identity material the node can fetch.

Microsoft refers to the vulnerability as Remote Code Execution, while the CVSS vector indicates a local vulnerability (AV:L). The attack begins with an authenticated tenant running code in their own pod, already possessing that position. The attacker then shops for any identity material the node can reach, which can be used for API calls or touching resources the assistant operates on.

This is due to assistant identities being tier-0 now, holding broad API permissions, and blending into legitimate automation, making audit entries appear normal until further investigation.

To mitigate this vulnerability, it is crucial to patch every pool past the fixed build, verify each pool's reported image version, and hunt for ../ and %2e%2e%2f paths pointing to sensitive directories. Additionally, alert on assistant identities performing node-adjacent activities or outside normal hours.