AKS path traversal CVE-2026-32193 chains node escape into possible Copilot hijack

A traversal rated 8.8

CVE-2026-32193 is, on paper, a path traversal in Azure Kubernetes Service: a CWE-22 flaw in AKS file path handling that scores 8.8 on CVSS. According to a writeup on dev.to, input is not canonicalized against a restricted base directory, so ../ sequences and absolute paths can escape the intended root. Microsoft ships the fix in node image build v0.20260213.5 through the AKS update channel, which, the author notes, points at Microsoft-built node-side components rather than upstream Kubernetes.

The official record is a single sentence, and the writeup argues that aggregators missed the real story. The bug surfaced in a June 2026 Patch Tuesday that carried 206 vulnerabilities and three disclosed zero-days, the largest on record per the writeup, and a "local" traversal with an EPSS of 0.00336 sank into that noise. Two of the most visible public writeups are openly machine-generated, the author adds, and one claims no vendor fix exists in the same entry that recommends applying the Microsoft update.

From pod to node root

The load-bearing detail in the CVSS vector, according to the writeup, is S:C, scope changed. The traversal is the entry point; the scope change describes the container-to-host escape. With root on a managed node, an attacker can reach the kubelet's credentials, every projected service account token on the machine, the container runtime socket, and whatever cloud identity material the node can fetch.

There is also a labeling discrepancy worth flagging. Microsoft's own title for the CVE says "Remote Code Execution," while the vector lists AV:L and vulnerability feeds state it is not remotely exploitable. The writeup's reading is that "local" is measured from the node, and an authenticated tenant already running code in its own pod holds exactly that position. That is an ordinary working deployment, not a high bar.

The Copilot hop

The researchers who found the bug headlined their work "From AKS node root vulnerability to Microsoft Copilot hijack." The dev.to writeup is explicit that this final stage is public only as a title, and the author flags the gap rather than inventing details. The attack class it implies is familiar, though: assistants wired into cloud control planes act through identities holding API permissions, usually broad ones, because the product promise is that the assistant does things on the user's behalf.

From a compromised node, an attacker goes shopping for reachable identity material. If any of it can call APIs the assistant trusts or touch resources the assistant operates on, node root stops being a node problem. The attacker needs no flaw in the assistant itself, only a path to something it trusts. An assistant identity is, in effect, a privilege concentrator: one identity with standing permissions acting for many users, whose activity blends into legitimate automation until someone asks why it was enumerating node credentials in the middle of the night.

Patching and detection

The writeup recommends upgrading every node pool past v0.20260213.5 using az aks nodepool upgrade --node-image-only, then verifying each pool's reported image version rather than assuming the system pool's fix propagated. On the identity side, it suggests listing all service accounts annotated with azure.workload.identity/client-id, pulling the Azure role assignments on each federated identity, and cutting anything that identity cannot justify. For detection: hunt for ../ and %2e%2e%2f patterns aimed at /etc, /var/lib/kubelet or /host mounts, watch for unexpected child processes under the kubelet, and alert when an assistant identity does anything node-adjacent or operates outside normal hours.

Why it matters

The distance between the one-line CVE record and the researchers' headline is the story. A routine-looking traversal becomes a tenant-wide problem when the node behind it holds credentials for automation, including AI assistants, with broad API permissions. Even if the Copilot stage is never fully documented, the structural lesson holds: model assistant identities like tier-0 accounts, because a node-side escape plus an over-scoped identity is a chain that generalizes well beyond this one CVE. With a single, openly opinionated source describing the chain, the practical move is to patch node pools now and treat the details of the Copilot step as emerging rather than settled.