Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database

Summary

Wiz discovered a critical vulnerability chain in Azure Cosmos DB (dubbed CosmosEscape) that could allow attackers to escape the Gremlin query sandbox, achieve arbitrary code execution, and obtain platform-wide signing secrets granting access to any customer database across tenants. Microsoft patched the vulnerable Gremlin entry point within 48 hours of the November 2025 report and completed a full regional fix by July 2026, eliminating the platform-wide key; Microsoft found no evidence of exploitation or customer impact.

Full text

Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Swati KhandelwalJul 30, 2026Vulnerability / Cloud Security A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz. Wiz, which codenamed the chain CosmosEscape, said the exploit chain began with a crafted query against a Gremlin database controlled by the attacker. From there, code execution on a multi-tenant gateway exposed a platform-wide signing secret and a regional account directory, allowing the researchers to locate a target and retrieve its primary account key. Microsoft blocked the vulnerable Gremlin entry point within 48 hours of the November 2025 report. Wiz said Microsoft completed the longer-term fix across all regions in July 2026 and eliminated the platform-wide key. "We appreciate Wiz's work in identifying and reporting this issue through coordinated vulnerability disclosure," a Microsoft spokesperson told The Hacker News. "We have fully addressed the issue and found no evidence of customer impact based on our investigations. We continue to invest in additional security enhancements across the platform." Microsoft said its review found no unauthorized activity outside the researchers' testing. It said no customer data was accessed and no customer action is required. The Hacker News has also reached out to Wiz for clarification of the exploit prerequisites and tested scope. This story will be updated with any response. The published chain starts with a Gremlin database controlled by the attacker and credentials for that account, not access to a victim database. Microsoft's current connection guide requires an account host, database, and graph path, and primary key before a client can submit Gremlin queries. Wiz has not published whether the exploit required anything beyond that starting point. According to Wiz's technical write-up, Cosmos DB's custom Gremlin engine translates Gremlin queries into .NET code and runs them inside a restricted environment. Wiz said the restrictions failed to account for .NET reflection, allowing the researchers to build file-read and file-write primitives before reaching arbitrary code execution. The public disclosure shows the output of a crafted query that executed the hostname command on the Cosmos DB backend, but not the query itself. The researchers said they will present the complete chain at a Black Hat USA briefing on August 6. The code execution landed on a component Wiz calls the DB Gateway, which executes customer queries on multi-tenant Azure Service Fabric clusters. Customer databases were not stored on those clusters, but the gateway could retrieve the primary key for a requested Cosmos DB account. Microsoft documentation says a Cosmos DB account primary key grants full control over all resources in that account. Credentials available to the gateway also provided access to a signing key that Wiz dubbed the Cosmos Master Key. Wiz said the gateway's signing key could retrieve the primary key for any account across tenants, regions, and the SQL, MongoDB, Cassandra, and Gremlin APIs. The same secret opened a regional database called the Config Store, described by Wiz as a directory containing Cosmos DB account names, subscription and tenant identifiers, network settings, and tags. An attacker could use it to find a specific organization's accounts and then request their primary keys. Wiz said the chain could also reach private and network-isolated accounts because the compromised gateway enforced those network boundaries from inside the service. The researchers' write access to the Config Store suggested network settings could also be changed, although the report does not say they demonstrated that against another customer's account. Microsoft documentation says Teams message data remains in Cosmos DB, while a Microsoft engineering post says Copilot stores users' queries and conversation histories there. Wiz said databases supporting those products were potentially accessible, but it did not report accessing their data. The public record does not say when the vulnerable engine and signing-key path entered production or what period Microsoft's log review covered. The duration of potential exposure therefore remains unknown, although the known path has since been closed. The disclosure lists no CVE identifier or severity score. CosmosEscape is technically separate from the ChaosDB and CosMiss flaws disclosed in 2021 and 2022, which involved Cosmos DB's Jupyter Notebook feature. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Access Control, Cloud security, Credential Security, data security, database security, Microsoft, remote code execution, Sandbox Escape, Vulnerability ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See

Indicators of Compromise

• malware — CosmosEscape

Entities