Researchers disclose SQL Copilot privilege escalation vulnerability CVE-2026-65669: from SELECT to SYSADMIN

Security researcher Johann disclosed the privilege escalation vulnerability CVE-2026-65669 in SQL Copilot in SQL Server Management Studio (SSMS) at BlueHat Asia 2026, which Microsoft rated as critical. Copilot executes SQL using the query window's database connection, so when a user connects as sysadmin, it has the same privileges; the so-called read-only mode relies only on the system prompt and a regex blacklist in the LocalSqlExecutionAccessChecker class, with no separate low-privilege connection. The author bypassed the blacklist by indirectly invoking stored procedures, allowing Copilot to execute write operations such as CREATE, INSERT, UPDATE, DELETE, and DROP, and demonstrated data exfiltration. In the full attack chain, a database owner plants malicious instructions in the database, which are triggered via indirect prompt injection when a high-privilege user uses Copilot, ultimately adding the attacker's login to the sysadmin role. The author recommends making the agent's read-only restriction an enforcement at the permission level and reminds users to update promptly.