SQL Copilot read-only bypass and privilege escalation vulnerability

1. 12:20
   X @wunderwuzzi23

   Researcher demonstrates hijacking Copilot in SQL Server Management Studio (CVE-2026-65669)

   Researcher wunderwuzzi23 posted a follow-up video post claiming to demonstrate privilege escalation from SELECT to SYSADMIN via Copilot in SQL Server Management Studio, tagged CVE-2026-65669. This is the author's vulnerability disclosure claim, not an independent reproduction or vendor confirmation.

1. 08:57
   公众号Doonsec· Discussion

   [Translation] From SELECT to SYSADMIN: Privilege escalation with SQL Copilot (CVE-2026-65669) Worth a look(opens the original post in a new tab)
2. 06:51
   X @wunderwuzzi23

   Researcher discloses privilege escalation path in SQL Copilot in SQL Server Management Studio

   Security researcher Johann Rehberger published research on SQL Copilot, the AI database assistant in Microsoft SQL Server Management Studio, finding a serious privilege escalation path from SELECT privileges to SYSADMIN. The author reminds users to ensure their SSMS installation is updated, thanks Microsoft for quickly patching the issue, and notes the research was also presented at BlueHat Asia two weeks ago. The author mentions the concept of a database CONSTITUTION.md file; full technical details and video demonstration are in the blog post.

3. 05:00
   Embrace The RedSelected

   Researchers disclose SQL Copilot privilege escalation vulnerability CVE-2026-65669: from SELECT to SYSADMIN

   Security researcher Johann disclosed the privilege escalation vulnerability CVE-2026-65669 in SQL Copilot in SQL Server Management Studio (SSMS) at BlueHat Asia 2026, which Microsoft rated as critical. Copilot executes SQL using the query window's database connection, so when a user connects as sysadmin, it has the same privileges; the so-called read-only mode relies only on the system prompt and a regex blacklist in the LocalSqlExecutionAccessChecker class, with no separate low-privilege connection. The author bypassed the blacklist by indirectly invoking stored procedures, allowing Copilot to execute write operations such as CREATE, INSERT, UPDATE, DELETE, and DROP, and demonstrated data exfiltration. In the full attack chain, a database owner plants malicious instructions in the database, which are triggered via indirect prompt injection when a high-privilege user uses Copilot, ultimately adding the attacker's login to the sysadmin role. The author recommends making the agent's read-only restriction an enforcement at the permission level and reminds users to update promptly.

Current attention59·Peak in the comparable period59（Oct 7 12:00）·Change over the comparable past 24 hours –