Microsoft Copilot Studio Exploit Leaks Sensitive Cloud Data

**Executive summary:** Tenable researchers discovered an SSRF vulnerability in Microsoft Copilot Studio (CVE-2024-38206) that could be abused via crafted HTTP requests and SSRF bypasses to retrieve IMDS-managed identity tokens and access internal Azure resources (including read/write access to a Cosmos DB instance), potentially affecting multiple tenants sharing the service; Microsoft quickly mitigated the issue and no user action was required.