Research Reveals SQL Copilot Flaw CVE-2026-65669 Can Turn DB Users Into Admins

Researcher discloses SQL Copilot privilege escalation flaw at BlueHat Asia 2026

Researcher Johann Rehberger gave a talk at BlueHat Asia 2026 in Singapore covering his research into the built-in Copilot feature in Microsoft SQL Server Management Studio (SSMS). According to his blog post, the research concerns CVE-2026-65669, an Elevation of Privilege Vulnerability rated ‘Critical’ by Microsoft.

Microsoft has released a patch. Rehberger reminds users to confirm their installed version is updated.

Copilot executes commands with the connected user’s privileges

Rehberger found that when Copilot runs in SSMS, it uses the privileges of whichever user is currently connected to the query window. In other words, if a user connects as sysadmin, Copilot will also run SQL commands using that sysadmin connection.

One tool, ReadFromDatabase, can read database contents and is in theory restricted by ‘read-only mode’. The system prompt explicitly instructs the model not to run queries that would change the database or server state. But Rehberger notes that system prompt instructions are not a real security boundary.

Regex-based guardrail can be bypassed

Through reverse engineering of the relevant code, Rehberger found that read-only mode enforcement relies on a regex-based classifier inside the LocalSqlExecutionAccessChecker class. He points out that blocklist-based security controls are inherently fragile and often have multiple bypass paths.

For example, a statement such as DECLARE @p sysname='sp_who'; EXEC @p can bypass the blocklist, allowing any stored procedure to be called. Combined with sp_executesql, an attacker can execute dynamically constructed arbitrary SQL queries, including write operations such as CREATE, INSERT, UPDATE, DELETE and DROP.

Indirect prompt injection can leak data and seize sysadmin privileges

Rehberger demonstrated exfiltrating database contents row by row to a third-party server, using xp_dirtree and the RestoreVerifyBackupFile tool, which is designed to verify backup files.

More critically, SQL Copilot supports ‘database instructions’ stored as AGENTS.md and CONSTITUTION.md. These instructions are added as extended properties via the sp_addextendedproperty stored procedure, and Copilot automatically loads them into context. Rehberger notes that the privilege required to modify this metadata can be lower than that of the user who later uses Copilot, allowing a low-privilege user to influence the behaviour of a higher-privilege user’s AI agent.

In the final demonstration, a user with db_owner privileges planted a malicious ‘database constitution’. When Copilot loaded it, an indirect prompt injection triggered a read-only mode bypass, executing arbitrary T-SQL commands using the victim’s SQL connection. This ultimately added the attacker to the sysadmin role, completing the full attack chain from db_owner to system administrator.

Rehberger urges treating read-only guardrails as security invariants

Rehberger concludes that read-only guardrails for AI agents must be genuine security invariants, such as privilege controls, rather than relying solely on model instructions or a fragile SQL classifier. He also warns that if Copilot operates using a high-privilege database connection, any failure of agent controls can affect the entire system.

He further notes that persistent instructions such as AGENTS.md and CONSTITUTION.md introduce a new trust relationship into the database privilege model. Extended properties are no longer just metadata, they are instructions that the AI assistant will follow. This incident involves risks related to prompt injection and AI agents, and belongs to the same category of AI agent abuse as the earlier MCP Python SDK OAuth flaw.