Critical Flaw in Azure Cosmos DB Could Have Exposed Databases to Unauthorized Access
A devastating security vulnerability in Microsoft’s Azure Cosmos DB database service could have allowed attackers to gain full read and write access to all databases on the platform. Dubbed “CosmosEscape” by cybersecurity firm Wiz, this critical flaw was discovered through a series of clever attacks that bypassed security restrictions and exploited the system’s own internal workings.
According to Wiz, the vulnerability stemmed from a combination of weaknesses in the Gremlin API, a graph query language used to interact with Cosmos DB databases. The issue lay in the way the custom Gremlin engine compiled queries into .NET code, which was then executed in a sandbox environment designed to prevent access beyond specific operations. However, Wiz’s researchers discovered that this enforcement could be bypassed through .NET reflection, allowing them to build arbitrary code execution primitives.
This exploit enabled Wiz to gain control of the DB Gateway, a service responsible for executing customer queries on their behalf. The gateway used a signing key to retrieve customer accounts’ primary keys and access their databases, but Wiz found that this key was valid across tenants, regions, and even APIs. In other words, they had obtained a platform-wide “Cosmos Master Key” that could retrieve the primary key for any Cosmos DB account on the service.
With this master key in hand, attackers could have enumerated all Cosmos DB accounts, filtered them by specific organization identifiers such as subscription and tenant IDs, and retrieved a target’s primary key to gain full read and write access to their databases. This attack vector even allowed Wiz to compromise private and network-isolated Cosmos DB accounts, including Microsoft’s own databases.
The vulnerability was reported to Microsoft in November 2025, and within two days, the company deployed a hotfix to block the attack vector. A long-term architectural fix was later rolled out across all regions in July. According to Microsoft, no customer data was accessed during this period, and there is no action required from customers.
The CosmosEscape vulnerability highlights the importance of ongoing security research and collaboration between vendors and cybersecurity experts. It also underscores the need for robust security measures within complex systems like Azure Cosmos DB, which rely on intricate interdependencies between various components. While Microsoft’s swift response to the issue has mitigated potential damage, it serves as a reminder that even seemingly secure systems can harbor vulnerabilities waiting to be exploited.
In light of this incident, organizations using Azure Cosmos DB should take extra precautions to ensure their databases are properly secured and monitored for any suspicious activity. Regular security audits and vulnerability assessments can help identify potential weaknesses before they are exploited by attackers. By staying vigilant and proactive in their security posture, organizations can minimize the risk of falling victim to similar vulnerabilities in the future.
Source: SecurityWeek — 2026-07-31