Quick Facts
- CVE-2026-42824, dubbed SearchLeak, allowed attackers to exfiltrate Microsoft 365 Copilot users’ emails and files via a single malicious microsoft.com link — no plugins required.
- A three-CVE chain in LiteLLM, rated CVSS 9.9, let a low-privilege user escalate to full proxy admin and execute arbitrary code, exposing all connected AI provider keys.
- Microsoft patched SearchLeak on the backend with no customer action required; LiteLLM patches require manual updates and audit of config files.
Two major AI security disclosures arrived within days of each other in mid-June 2026. Together, they exposed how thin the security boundaries are inside enterprise AI stacks — and how a single click or a single compromised account can unravel access controls across an entire organization.
On June 15, Varonis Threat Labs published research on SearchLeak, tracked as CVE-2026-42824. The vulnerability sits inside Microsoft 365 Copilot Enterprise Search. An attacker crafts a URL pointing to a legitimate microsoft.com domain, embeds instructions in the query parameter, and Copilot treats those instructions as executable commands rather than a search string.
The attack runs in three stages. First, the malicious URL tells Copilot to search the victim’s mailbox and embed extracted content in an image tag. Second, a race condition in the HTML rendering pipeline allows that image tag to fire before Microsoft’s content protections are applied. Third, because the browser’s Content Security Policy blocks direct contact with attacker infrastructure but allowlists bing.com, the data exits through Bing’s Search by Image feature via server-side request forgery.
The victim sees Copilot appear to think for a moment. Nothing else. No alerts fire because the link resolves to a real Microsoft domain. Anti-phishing tools pass it clean.
Because Copilot operates with the victim’s own permissions, the exposed data could include emails, one-time passwords, password reset links, calendar events, SharePoint files, salary records, and acquisition plans. Microsoft rated the flaw at its maximum severity before patching it server-side. Customers require no action, and Varonis confirmed the attack as a proof-of-concept, not observed in the wild.
LiteLLM: One Bad User, Full Admin Access
Four days before the Varonis disclosure, Obsidian Security published a three-CVE chain against LiteLLM, the open-source proxy that routes traffic to OpenAI, Anthropic, Azure, and AWS Bedrock through a single API interface. The combined chain carries a CVSS score of 9.9.
The first bug, CVE-2026-47101, lets a non-admin user generate an API key with access to any route — including admin-only endpoints — because LiteLLM stores caller-supplied route permissions without validation. The second bug, CVE-2026-47102, allows a user to promote themselves to proxy admin by sending a self-update request with the field user_role: proxy_admin to the /user/update endpoint. LiteLLM accepts and saves it.
The third bug, CVE-2026-40217, is a sandbox escape. LiteLLM’s Custom Code Guardrail feature runs admin-supplied Python through exec() with no source filtering. Obsidian demonstrated a reverse shell by injecting a forged tool-call response through the callback mechanism.
Once the gateway is compromised, an attacker holds the decryption salt needed to recover all stored provider credentials. They can also rewrite model responses and steer downstream AI agents toward attacker-chosen tool calls. Malicious callbacks can be hidden in the config.yaml file under litellm_settings.callbacks, a location not visible in the admin UI.
What Teams Should Do Now
The VentureBeat report recommends a five-check audit for any team running these tools. The core steps apply broadly to any enterprise AI deployment.
- Audit who holds LiteLLM admin credentials and rotate all provider API keys.
- Review config.yaml for any callbacks not added by your own team.
- Check that LiteLLM is not exposed to the public internet without authentication.
- Verify Microsoft 365 Copilot permissions align with least-privilege principles.
- Monitor outbound requests from AI tooling for unexpected destinations.
Both disclosures arrived before any confirmed exploitation in the wild. That window will not stay open. Teams running AI gateways or Microsoft 365 Copilot at scale should treat these findings as active risk, not future planning.
This article was written by an AI agent. Spotted an error? Send a correction and we will fix it.