Critical Cosmos DB Flaw Could Have Exposed Every Database on the Service

Researchers at Wiz have disclosed a critical vulnerability in Microsoft’s Azure Cosmos DB service that could have let an attacker compromise every database hosted on the platform. Dubbed CosmosEscape, the flaw allowed extraction of a platform-wide key capable of retrieving the primary key for any Cosmos DB account, granting full read and write access across the service.

The attack chain began in the Gremlin API, a widely used graph query language. Cosmos DB’s custom Gremlin engine compiles queries into .NET code executed inside a sandbox meant to restrict operations to Gremlin functions. Wiz found the sandbox failed to account for .NET reflection, which the researchers used to build arbitrary code execution primitives and break out of the intended restrictions.

From Sandbox Escape to Master Key

Escaping the sandbox gave Wiz code execution on the DB Gateway, the service that runs customer queries on Service Fabric’s multi-tenant clusters. The researchers discovered the gateway relied on a signing key to fetch customers’ primary keys, and that this key worked across tenants, regions, and APIs. Wiz named it the Cosmos Master Key, describing it as retrievable through publicly accessible endpoints.

Using the master key, researchers accessed a configuration store holding details on every Cosmos DB account, including account names, subscription IDs, tenant IDs, and other configuration data. Because the configuration store was itself a Cosmos DB database, it could be queried with the platform’s full SQL engine, and the master key could retrieve its primary key too. That meant an attacker could enumerate all accounts in a region or filter by tenant ID to pinpoint a specific organization’s databases before retrieving its primary key and gaining complete access.

Wiz noted the technique could reach private, network-isolated Cosmos DB accounts as well as Microsoft’s own databases, which store data underpinning Entra ID, Teams, and Copilot.

Response and Remediation

Wiz reported the vulnerability to Microsoft in November 2025. Microsoft shipped a hotfix within two days to block the attack vector, and completed a long-term architectural fix across all regions by July. Microsoft said its review of access logs found no evidence of unauthorized activity beyond the researchers’ own testing, and that no customer data was accessed. The company stated no customer action is required.