Item detail

Microsoft 365 Copilot 'SearchLeak' data-theft chain (CVE-2026-26137)

Varonis Threat Labs disclosed a 3-stage chain (parameter-to-prompt injection, HTML-injection race, and SSRF via Bing) in M365 Copilot Enterprise Search that turns Copilot into a one-click data exfiltration tool for mailboxes, MFA codes, calendars, and files.

Score8.0
Popularity65.0
Risknone
TierGold
Score breakdown
Usefulness8.0
Novelty7.2
Momentum6.2
Maturity7.7
Open-source/build5.8
Evidence5.8
Workflow potential8.0
Setup ease6.5

Popularity is tracked separately. Support, ads, sponsorships, and tips never affect these signals.

Why it matters

Useful for security teams and AI-app builders: the underlying technique (P2P injection chained with cross-service SSRF) generalizes to any AI assistant that combines retrieval with outbound rendering. Audit M365 Copilot query logs and consider restricting access to sensitive libraries until mitigations ship.

Who should use it

BuildersPower users

Who should skip it

Skip if the source link, docs, or setup requirements do not match your workflow.

Risk explanation

No inherent user-impacting risk is flagged from the captured evidence.

Evidence links

Closest alternatives / related signals