A critical vulnerability in the Azure Cosmos DB database service could have allowed attackers to compromise all databases on the service, cybersecurity outfit Wiz reports.
Referred to as CosmosEscape, the security defect could have allowed an attacker to obtain a platform-wide key and retrieve the primary key of any Cosmos DB account, gaining full read and write access across the service.
Armed with the key, an attacker could have listed all databases on the service, filtering them by specific organization identifiers, such as subscription and tenant IDs.
“Chained together, these capabilities could have enabled precision targeting at platform scale: from identifying a specific organization’s databases to compromising them, all from publicly accessible endpoints,” Wiz says.
According to the cybersecurity firm, because Microsoft uses Cosmos DB to store data across Entra ID, Teams, and Copilot, the vulnerability potentially exposed the tech giant’s databases to unauthorized access.
The issue could have been exploited through the Gremlin API, a popular graph query language that relies on a custom Gremlin engine, compiling queries into .NET code that was executed in a sandbox.
Pwning the sandbox
While the engine enforced restrictions to prevent access beyond Gremlin operations, it did not account for .NET reflection, which Wiz used to build arbitrary code execution primitives.
“By bypassing the Gremlin sandbox, we’ve gained code execution on the DB Gateway, a service that executes customer queries on their behalf, running on multi-tenant Service Fabric clusters,” Wiz explains.
The cybersecurity firm then discovered that the gateway was using a signing key to retrieve customer accounts’ primary keys and access their databases, and that the signing key worked across tenants, regions, and even APIs.
“It was a platform-wide key that could retrieve the primary key for any Cosmos DB account on the service, all through publicly accessible endpoints. We dubbed it the Cosmos Master Key,” Wiz notes.
Through the master key, the cybersecurity firm’s researchers could access a configuration store containing details on every Cosmos DB account, including names, subscription IDs, tenant IDs, and various other configuration data.
Pwning the databases
“The Config Store was itself a Cosmos DB database, meaning it could be queried with the full flexibility of CosmosDB’s SQL engine. It also meant that the Cosmos Master Key could retrieve its primary key – enabling attackers that exploited CosmosEscape to list all accounts in a region, or query by specific tenant ID to identify a specific organization’s databases,” the company explains.
An attacker with the master key and access to the configuration store could enumerate all Cosmos DB accounts, filter them, and retrieve a target’s primary key to gain full read and write access to all their databases.
According to Wiz, the attack could also be mounted against private and network-isolated Cosmos DB accounts, as well as Microsoft’s own databases.
Wiz reported the vulnerability to Microsoft in November 2025. Within two days, Microsoft deployed a hotfix to block the attack vector. In July, the tech giant completed the rollout of a long-term architectural fix across all regions.
“Microsoft conducted extensive reviews of access logs and found no evidence of unauthorized activity outside of the researcher’s testing activity, and no customer data was accessed. There is no customer action required,” the company said.
Related: Critical Code Execution Vulnerability Patched in TeamCity
Related: JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack
Related: Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe
Related: Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day
