Wiz Research has disclosed a vulnerability chain in Azure Cosmos DB that could have given an attacker full read and write access to every database on the service, including Microsoft’s own.
The chain, which Wiz called CosmosEscape, started in the Gremlin API, one of several query languages Cosmos DB supports.
A .NET exception tipped the researchers off that Microsoft had built a custom Gremlin engine compiling queries into executable code. The engine’s restrictions did not sufficiently account for .NET reflection, letting the team reach code execution from queries against their own database.
That put them on the DB Gateway, the multi-tenant service that runs customer queries. The gateway reaches databases using the account’s primary key, and Wiz found it obtained those keys through a signing key accessible via credentials stored on the cluster.
The signing key was not scoped to a single account. It worked across tenants, regions, and every Cosmos DB API flavor, and could retrieve the primary key for any account on the service through publicly accessible endpoints. Wiz named it the Cosmos Master Key.
The same key unlocked the Config Store, a regional registry of every Cosmos DB account holding names, subscription IDs, tenant IDs, and network settings. It was itself a Cosmos DB database, so an attacker could query it to find a specific organization’s databases before compromising them.
Microsoft’s Own Infrastructure Was In Scope
Cosmos DB sits in Azure’s infrastructure tier and underpins Microsoft Entra ID, Teams, and Copilot, all of which store data there. Wiz said those internal databases were equally exposed, raising the prospect of a cross-service attack.
Microsoft has fully remediated the issue and eliminated the Cosmos Master Key. It said access log reviews found no unauthorized activity outside the researchers’ testing and no customer data was accessed, and that no customer action is required.
The timeline stretched eight months, with Wiz reporting the flaw on November 20, 2025, and Microsoft a hotfix being shipped two days later, but the architectural fix took until July 2026 to reach all regions.
No CVE has been assigned. Wiz said the research was assisted by an early version of Atlas, Wiz’s AI-assisted vulnerability research tool, and will present the full chain at Black Hat USA this week.
