CosmosEscape: A now-closed security vulnerability in Microsoft Azure could have had far-reaching consequences for companies. Security researchers at Wiz discovered a chain of vulnerabilities in Azure Cosmos DB that, under certain conditions, could have allowed attackers to gain access to other customers' databases. The Wiz security experts dubbed the vulnerability CosmosEscape. The problem lay in the Gremlin interface of Azure Cosmos DB, which is used, among other things, for working with graph databases. According to the security researchers, they were able to bypass the security restrictions in place and escape from an isolated execution environment. In this way, it was possible to… Read more

Eine Verkettung von Sicherheitslücken ermöglichte vollen Zugang zu allen Azure-Cosmos-DB-Datenbanken.

Eine Verkettung von Sicherheitslücken ermöglichte vollen Zugang zu allen Azure-Cosmos-DB-Datenbanken.

Stell dir vor, Du kannst auf jede Microsoft Azure Cosmos DB in der Cloud zugreifen, weil Du den Masterkey kennst? Klingt irre, aber Sicherheitsforschern von Wiz ist genau dieser Masterkey in die…

Cybersecurity researchers at Wiz found CosmosEscape in Azure's Gremlin API, exposing a master key that could access any Cosmos DB account. Microsoft fixed it, with no customer impact found.

Das IT-Sicherheitsunternehmen Wiz hat Details zu einer schwerwiegenden Schwachstelle in der Microsoft-Plattform Azure veröffentlicht, die weitreichende Zugriffsmöglichkeiten auf Cloud-Infrastrukturen eröffnete. Die als „CosmosEscape“ bezeichnete Sicherheitslücke betraf die Gremlin-Programmierschnittstelle (API) von Azure Cosmos DB. Durch den Fehler war es möglich, aus der vorgesehenen isolierten Umgebung auszubrechen und administrativen Zugriff auf zentrale Datenbank-Systeme zu erlangen.Nach Angaben der […] The post CosmosEscape: Kritische Lücke in Azure Cosmos DB geschlossen appeared first on BornCity.

Wiz Research details CosmosEscape, a critical vulnerability in Azure Cosmos DB that granted full read/write access to every database. Now fully remediated.

CosmosEscape, a critical vulnerability in Azure, could have allowed attackers to compromise any database on the Cosmos DB service.

Wiz Research details CosmosEscape, a critical vulnerability in Azure Cosmos DB that granted full read/write access to every database. Now fully remediated.

Curate Feeds | Make Collections | Customize Email Briefs

A now-patched flaw in Azure Cosmos DB could have let an attacker break out of the Gremlin query sandbox and gain cross-tenant read and write access through a chain Wiz named CosmosEscape. Microsoft says it fixed the issue, removed the platform-wide key, and found no evidence of customer impact or unauthorized...

A critical vulnerability, dubbed CosmosEscape, in Microsoft Azure Cosmos DB could have let attackers seize control of virtually every database hosted on the service, including Microsoft’s own internal systems. The vulnerability resided in Cosmos DB’s Gremlin API and, if exploited, could have enabled a cross-tenant attack affecting millions of customer workloads and Microsoft’s internal infrastructure. Understanding these structural risks is increasingly vital when evaluating broader cloud platform security across multi-tenant enterprise environments. New CosmosEscape Vulnerability Wiz researchers were experimenting with Gremlin, a popular graph query language supported by Cosmos DB, when they noticed an unusual .NET exception. Since most open-source Gremlin implementations run on the Java Virtual Machine (JVM), this suggested that Cosmos DB used a custom.NET-based Gremlin engine instead. That distinction mattered because Gremlin servers typically compile queries into executable code and run them inside a restricted sandbox, and such sandboxes have historically proven fragile against determined attackers. That suspicion paid off. The team discovered that Cosmos DB’s engine translated Gremlin queries into .NET code but failed to adequately restrict .NET reflection, a feature that lets code inspect and manipulate other code at runtime. By exploiting this gap, researchers built file read, file write, and, eventually, full arbitrary code execution capabilities using nothing more than crafted queries run against their own database. In a striking proof of concept, a specially designed Gremlin query executed the hostname command directly on Cosmos DB’s backend infrastructure. Executing hostname on the Cosmos DB This code execution gave researchers a foothold on the DB Gateway, the multi-tenant component responsible for running customer queries. While customer databases weren’t stored on the same clusters, the Gateway still needed a way to reach them, and it did so using a signing key capable of retrieving any account’s primary key. Crucially, this signing key wasn’t scoped to a single customer or region; it worked across tenants, regions, and API formats including SQL, MongoDB, Cassandra, and Gremlin. Wiz dubbed this powerful secret the Cosmos Master Key. The Master Key also unlocked access to the Config Store, essentially Cosmos DB’s master directory listing every account on the platform along with subscription IDs, tenant IDs, network rules, and tags. CosmosEscape’s Attack Chain Because the Config Store was itself a queryable Cosmos DB database, attackers could have used it to enumerate every account in a region or filter results by tenant ID to precisely target a specific organization. According to analysis published on the Wiz Research Blog , chaining sandbox escapes with unscoped signing keys bypasses fundamental cloud isolation boundaries. These architectural risks align with broader Microsoft vulnerability trends , in which overprivileged machine accounts and underlying service permissions amplify the potential blast radius of a single flaw. Chaining these two capabilities together created a devastating attack path: enumerate targets through the Config Store, then use the Master Key to pull their primary key and gain full read-write access to their data. Because Cosmos DB underpins major Microsoft services such as Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot, the exposure extended well beyond ordinary enterprise customers into Microsoft’s own backend systems. CosmosEscape’s impact. Even private, network-isolated databases were at risk, since the compromised DB Gateway itself enforced that isolation. Evaluating these cross-tenant vectors underscores why security teams must continuously audit for cloud logging threats and unexpected access patterns across critical data stores. Attack Lifecycle Stage Exploit Mechanism Impact & Scope Gremlin Sandbox Escape Unrestricted .NET reflection in query translation Arbitrary code execution on DB Gateway Credential Retrieval Unscoped DB Gateway signing key extraction Access to global Cosmos Master Key Target Discovery Querying Cosmos DB Config Store directory Enumeration of all accounts, tenant IDs, and network policies Data Compromise Primary key generation via DB Gateway Full read-write access across all tenants and regions Wiz responsibly disclosed CosmosEscape to Microsoft, which deployed a rapid hotfix and has since fully remediated the issue by eliminating the Cosmos Master Key entirely and adding new architectural safeguards. Microsoft’s investigation found no evidence that the vulnerability was exploited maliciously prior to disclosure, and no action is required from Azure Cosmos DB customers.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post New CosmosEscape Vulnerability Allowed Attackers to Take Over Azure Cosmos DB Instances appeared first on Cyber Security News .

Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access. The post Critical Flaw Led to Azure Cosmos DB Pwnage appeared first on SecurityWeek .

Wiz Research disclosed CosmosEscape, a chain that escaped Azure Cosmos DB's Gremlin sandbox and reached a platform-wide key granting read and write access to every database on the service. Microsoft b...

A critical vulnerability in Microsoft Azure’s Cosmos DB database service could have enabled attackers to escape the platform’s Gremlin query sandbox, execute code on shared infrastructure, and ultimately gain access to any customer’s database, including data stores used by Microsoft services such as Entra ID, Teams, and Copilot, according to research published by cloud security firm Wiz. The vulnerability, dubbed CosmosEscape, relied on a chain of flaws that allowed Wiz researchers to obtain what they called the “Cosmos Master Key,” a platform-wide credential capable of retrieving the primary key for any Azure Cosmos DB account. “Chained together, these capabilities could have enabled precision targeting at platform scale: from identifying a specific organization’s databases to compromising them, all from publicly accessible endpoints,” Wiz researchers Yuval Avrahami and Lior Maman wrote in a blog post. ## Exploiting the service’s query engine According to Wiz, the attack originated in the Gremlin API, one of several query interfaces supported by Azure Cosmos DB. While testing Gremlin queries, the researchers observed .NET exceptions suggesting Microsoft was using a custom Gremlin execution engine rather than a standard implementation. The researchers found they could exploit insufficient restrictions around .NET reflection to escape the Gremlin sandbox and achieve arbitrary code execution on the Cosmos DB Database Gateway, the service responsible for executing customer queries. That access exposed credentials capable of retrieving the primary key for any Cosmos DB account—not just the researchers’ own database. According to Wiz, the same platform credential also unlocked Cosmos DB’s regional configuration store, allowing attackers to enumerate database accounts by tenant or subscription ID before retrieving their primary keys. “We soon discovered the signing key wasn’t scoped to a single account,” Wiz said in its blog. “It worked across tenants, regions, and even API flavors — SQL, MongoDB, Cassandra, and Gremlin.” The researchers added that the exploit chain affected more than just customer workloads. Because Cosmos DB underpins several Microsoft cloud services, databases supporting Microsoft Entra ID, Teams, and Copilot were also potentially accessible. Private and network-isolated Cosmos DB deployments were likewise exposed because the compromised Database Gateway was responsible for enforcing those network boundaries, the blog added. ## Microsoft says no evidence of exploitation Wiz said it privately disclosed the vulnerability to Microsoft on Nov. 20, 2025. According to the published disclosure timeline, Microsoft blocked the vulnerable Gremlin attack path within 48 hours before completing a broader architectural redesign across all Azure regions in July 2026. Microsoft has since fully remediated the vulnerability. In a statement published alongside Wiz’s disclosure, the company said its investigation found no evidence of unauthorized activity beyond the researchers’ testing, that no customer data was accessed, and that no customer action is required. “No customer action is required,” the blog added, quoting Microsoft. Wiz said Microsoft also eliminated the platform-wide authentication mechanism it dubbed the “Cosmos Master Key.” Microsoft did not immediately respond to a request for additional comment. ## Enterprises should examine provider isolation While Microsoft said customers do not need to take any immediate action, the disclosure highlights risks that exist below the security controls cloud customers typically manage themselves, said Sakshi Grover, senior research manager at IDC. “CosmosEscape demonstrates that tenant isolation can fail below the layers customers are able to configure or monitor,” Grover said. Rather than evaluating managed database services primarily on features such as encryption, private networking, or identity controls, enterprises should examine how providers isolate tenant-controlled execution from privileged service components, scope internal credentials, and contain the impact if shared infrastructure is compromised, she said. Grover said Microsoft’s assessment should carry significant weight because only the company has visibility into its service-plane telemetry. However, organizations using the Cosmos DB Gremlin API should review available logs, determine whether sensitive workloads were affected, and seek additional assurance from Microsoft where regulatory or compliance requirements demand it. The incident should also prompt organizations to reduce long-term reliance on static database account keys by adopting managed identities, fine-grained role-based access controls, and client-side encryption where practical, she said. More broadly, Grover said the vulnerability illustrates the importance of scrutinizing privilege boundaries within hyperscale cloud platforms. “Hyperscale services often depend on privileged gateways, control planes, metadata stores and service identities that operate across large numbers of customers,” she said. “Whenever tenant-controlled input is processed close to those components, a vulnerability can cross what appeared to be separate security boundaries and create platform-scale consequences.”

Wiz Research details CosmosEscape, a critical vulnerability in Azure Cosmos DB that granted full read/write access to every database. Now fully remediated.

Wiz Research details CosmosEscape, a critical vulnerability in Azure Cosmos DB that granted full read/write access to every database. Now fully remediated.