Critical Azure Cosmos DB flaw threatened cross-tenant database takeover

A critical vulnerability in Microsoft Azure’s Cosmos DB database service could have enabled attackers to escape the platform’s Gremlin query sandbox, execute code on shared infrastructure, and ultimately gain access to any customer’s database, including data stores used by Microsoft services such as Entra ID, Teams, and Copilot, according to research published by cloud security firm Wiz. The vulnerability, dubbed CosmosEscape, relied on a chain of flaws that allowed Wiz researchers to obtain what they called the “Cosmos Master Key,” a platform-wide credential capable of retrieving the primary key for any Azure Cosmos DB account. “Chained together, these capabilities could have enabled precision targeting at platform scale: from identifying a specific organization’s databases to compromising them, all from publicly accessible endpoints,” Wiz researchers Yuval Avrahami and Lior Maman wrote in a blog post. Exploiting the service’s query engine According to Wiz, the attack originated in the Gremlin API, one of several query interfaces supported by Azure Cosmos DB. While testing Gremlin queries, the researchers observed .NET exceptions suggesting Microsoft was using a custom Gremlin execution engine rather than a standard implementation. The researchers found they could exploit insufficient restrictions around .NET reflection to escape the Gremlin sandbox and achieve arbitrary code execution on the Cosmos DB Database Gateway, the service responsible for executing customer queries. That access exposed credentials capable of retrieving the primary key for any Cosmos DB account—not just the researchers’ own database. According to Wiz, the same platform credential also unlocked Cosmos DB’s regional configuration store, allowing attackers to enumerate database accounts by tenant or subscription ID before retrieving their primary keys. “We soon discovered the signing key wasn’t scoped to a single account,” Wiz said in its blog. “It worked across tenants, regions, and even API flavors — SQL, MongoDB, Cassandra, and Gremlin.” The researchers added that the exploit chain affected more than just customer workloads. Because Cosmos DB underpins several Microsoft cloud services, databases supporting Microsoft Entra ID, Teams, and Copilot were also potentially accessible. Private and network-isolated Cosmos DB deployments were likewise exposed because the compromised Database Gateway was responsible for enforcing those network boundaries, the blog added. Microsoft says no evidence of exploitation Wiz said it privately disclosed the vulnerability to Microsoft on Nov. 20, 2025. According to the published disclosure timeline, Microsoft blocked the vulnerable Gremlin attack path within 48 hours before completing a broader architectural redesign across all Azure regions in July 2026. Microsoft has since fully remediated the vulnerability. In a statement published alongside Wiz’s disclosure, the company said its investigation found no evidence of unauthorized activity beyond the researchers’ testing, that no customer data was accessed, and that no customer action is required. “No customer action is required,” the blog added, quoting Microsoft. Wiz said Microsoft also eliminated the platform-wide authentication mechanism it dubbed the “Cosmos Master Key.” Microsoft did not immediately respond to a request for additional comment. Enterprises should examine provider isolation While Microsoft said customers do not need to take any immediate action, the disclosure highlights risks that exist below the security controls cloud customers typically manage themselves, said Sakshi Grover, senior research manager at IDC. “CosmosEscape demonstrates that tenant isolation can fail below the layers customers are able to configure or monitor,” Grover said. Rather than evaluating managed database services primarily on features such as encryption, private networking, or identity controls, enterprises should examine how providers isolate tenant-controlled execution from privileged service components, scope internal credentials, and contain the impact if shared infrastructure is compromised, she said. Grover said Microsoft’s assessment should carry significant weight because only the company has visibility into its service-plane telemetry. However, organizations using the Cosmos DB Gremlin API should review available logs, determine whether sensitive workloads were affected, and seek additional assurance from Microsoft where regulatory or compliance requirements demand it. The incident should also prompt organizations to reduce long-term reliance on static database account keys by adopting managed identities, fine-grained role-based access controls, and client-side encryption where practical, she said. More broadly, Grover said the vulnerability illustrates the importance of scrutinizing privilege boundaries within hyperscale cloud platforms. “Hyperscale services often depend on privileged gateways, control planes, metadata stores and service identities that operate across large numbers of customers,” she said. “Whenever tenant-controlled input is processed close to those components, a vulnerability can cross what appeared to be separate security boundaries and create platform-scale consequences.”