Critical Flaw Exposed Azure Cosmos DB to Unauthorized Access
A critical vulnerability in Microsoft’s Azure Cosmos DB database service could have allowed attackers to compromise all databases on the platform, potentially giving them access to sensitive data from top tech companies. The flaw, dubbed “CosmosEscape,” was discovered by cybersecurity firm Wiz and reported to Microsoft in November 2025.
The issue worked as follows: an attacker could use the Gremlin API, a graph query language used to interact with Cosmos DB, to obtain a platform-wide key that granted access to any database on the service. This key, which Wiz dubbed the “Cosmos Master Key,” could be used to list all databases on the service, filter them by specific organization identifiers such as subscription and tenant IDs, and retrieve the primary key of any account. With this information, an attacker could gain full read and write access to all databases on the platform.
The vulnerability was caused by a weakness in the custom Gremlin engine used by Cosmos DB. The engine compiled queries into .NET code that was executed in a sandbox, but it did not account for “reflection,” a technique used to bypass security restrictions and execute arbitrary code. Wiz exploited this weakness to build code execution primitives, which allowed them to bypass the Gremlin sandbox and access sensitive data on the platform.
The implications of this flaw are significant, as Microsoft uses Cosmos DB to store data from its own services such as Entra ID, Teams, and Copilot. This means that the vulnerability could have exposed sensitive data from these platforms to unauthorized access. According to Wiz, an attacker with the master key and access to the configuration store could enumerate all Cosmos DB accounts, filter them, and retrieve a target’s primary key to gain full read and write access to all their databases.
Fortunately, Microsoft acted quickly to address the issue. After being notified by Wiz in November 2025, the company deployed a hotfix within two days to block the attack vector. In July, they completed the rollout of a long-term architectural fix across all regions. While there is no evidence that any customer data was accessed as a result of this vulnerability, it serves as a reminder of the importance of staying vigilant and proactive in addressing potential security threats.
For users of Azure Cosmos DB, the takeaway from this incident is clear: even with robust security measures in place, vulnerabilities can still arise. It’s essential to stay informed about potential risks and to work closely with service providers like Microsoft to address these issues before they can be exploited by attackers. By doing so, we can ensure that our sensitive data remains secure and protected against unauthorized access.
Source: SecurityWeek — 2026-07-31