Microsoft has closed a vulnerability chain in Azure Cosmos DB that would have let anyone with a throwaway test account read and write data in every database on the service — including the internal ones behind Entra ID, Teams, and Copilot.
Wiz Research, which disclosed the flaw on Wednesday under the name CosmosEscape, needed nothing but its own Cosmos DB account to get there. No stolen credentials, no access to the victim tenant, no misconfiguration on the customer's side. The entry point was a public endpoint.
The trail started with an error message. While running Gremlin queries — Gremlin is a graph query language, one of several APIs Cosmos DB accepts — researchers hit a .NET exception. Almost every open-source Gremlin stack runs on the JVM, so a .NET error meant Microsoft had built its own engine, one that compiles queries into executable code and runs them in a sandbox.
 |
| CosmosEscape’s Attack Chain | Inage- Wiz |
Those sandboxes have a poor track record, and this one was no exception: its restrictions failed to account for .NET reflection (a feature that lets code inspect and invoke other code at runtime). Wiz turned that gap into file reads, file writes, and eventually command execution, publishing a screenshot of the hostname running on a Microsoft backend host.
That code ran on the DB Gateway, the multi-tenant service that executes customer queries. Sitting on the cluster was a signing key scoped to nothing at all — not an account, not a region, not an API flavor. It retrieved primary keys for SQL, MongoDB, Cassandra, and Gremlin accounts alike. Wiz named it the Cosmos Master Key.
The same key opened the Config Store, a regional directory listing every Cosmos DB account with its subscription ID, tenant ID, and network rules. Because the directory is itself a Cosmos DB database, attackers could query it with SQL, filter by tenant, and pick a target company by name — then unlock it. Private, network-isolated accounts offer no shelter, since the compromised gateway enforces that isolation.
Wiz reported the bug on November 20, 2025. Microsoft blocked the Gremlin entry point within 48 hours, then spent the next eight months migrating Cosmos DB to a hardened architecture, finishing the rollout across all regions in July 2026. The Cosmos Master Key no longer exists. Microsoft says log reviews found "no evidence of unauthorized activity outside of the researcher's testing" and that no customer data was touched.
It is the second time Wiz has broken Cosmos DB tenant isolation. The 2021 ChaosDB bug, which exploited the service's Jupyter Notebook feature, led Microsoft to urge customers to regenerate their primary keys. This time, there is no such advisory — the fix lives entirely on Microsoft's side.
Still, "no action required" is not the same as nothing to do. Teams running Cosmos DB should treat primary keys as the liability they are: shift data-plane access to Entra ID role-based access control, set disableLocalAuth to shut off key authentication entirely, and lock accounts behind private endpoints. A stolen key only matters if the key still works.
Wiz will publish the full exploitation chain at Black Hat USA in a talk titled One Key to Rule Them All: Taking Over a Flagship Cloud Service.