From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669)

What it is

CVE-2026-65669 is a critical SQL Server elevation of privilege flaw in Copilot in SQL Server Management Studio (SSMS), found by Johann Rehberger (Embrace The Red) and presented at BlueHat Asia 2026 in Singapore. A user with only db_owner rights can plant instructions that make Copilot run T/SQL as a higher-privileged victim, ending with the attacker in the sysadmin role. The page tells readers to make sure their installations are up to date. It gives no fixed version number.

How it works

Copilot runs SQL over the connection of the open Query Window, so it has the privileges of the connected user. A sysadmin session gives Copilot sysadmin rights.

"Read-only" mode is enforced by two weak layers:

• The system prompt tells the model it is read-only. The page notes this is not a security boundary.
• A regex blocklist in the LocalSqlExecutionAccessChecker class, found by decompiling the ReadFromDatabase tool with ILSpy. There was no separate low-privilege connection and no permission-level read-only enforcement.

The blocklist is bypassed by calling a procedure through a variable. This runs any stored procedure:

DECLARE @p sysname='sp_who'; EXEC @p

Using sp_executesql the same way gives arbitrary SQL, including DROP:

DECLARE @p sysname='sp_executesql'; EXEC @p N'DROP TABLE [Test];'

A second path is the RestoreVerifyBackupFile tool. Despite being meant for backup verification, it passes arbitrary T/SQL through for execution.

Data exfiltration works two ways. xp_dirtree called via ReadFromDatabase places row data in an SMB path to a third-party server, one row at a time. RestoreVerifyBackupFile is the other route.

The privilege escalation depends on indirect prompt injection. Copilot reads database instructions stored as extended properties: CONSTITUTION.md applies database-wide, and AGENTS.md applies to an object such as a table or column. They are written with sp_addextendedproperty. A user with ALTER permission on an object can attach AGENTS.md to it, which can be a lower privilege than the user who later runs Copilot.

flowchart LR
    A[db_owner attacker] -->|plants CONSTITUTION.md| B[Extended property]
    B -->|loaded into context| C[Victim's Copilot session]
    C -->|regex bypass| D[Arbitrary T/SQL]
    D -->|victim's connection| E[Attacker added to sysadmin]

The author also shows a comment in a file hijacking Copilot into an UPDATE through RestoreVerifyBackupFile.

Preconditions / Affected

• A victim who uses Copilot in SSMS and asks it to inspect content the attacker controls (database content, T/SQL files, schema or metadata).
• An attacker who can write extended properties (ALTER on an object, or db_owner for the full chain).
• Impact scales with the victim's connection. A sysadmin connection gives system-wide impact.
• The author's initial research was in May 2026. The page says Microsoft has since added MCP support and does not say whether that changes exposure.

What to do

• Update SSMS/Copilot to the patched release. The page gives no version.
• Do not use Copilot over highly privileged connections such as sysadmin.
• Use Microsoft's administrative controls: disable Copilot, configure group policies, and set an execution context.
• Treat AGENTS.md and CONSTITUTION.md extended properties as instructions the assistant will follow. Review who holds ALTER rights.
• Read-only enforcement for an agent should be a permission, not a model instruction or SQL classifier.

Caveats

The author notes that letting users pick the underlying model may weaken safety, though this should not matter if read-only is enforced properly. The page gives no detection queries and no patched build number. Slides and a video demo are linked from the post.