Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover

Summary

Wiz researchers discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API that allowed attackers with their own Azure account to extract a platform-wide master key and gain unauthorized access to any customer's database. The flaw enabled attackers to list and retrieve primary keys for any Cosmos DB instance, including those used by Microsoft services like Teams and Entra ID. Microsoft has patched the vulnerability with no evidence of exploitation found.

Full text

SecurityMicrosoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover Cybersecurity researchers at Wiz found CosmosEscape in Azure’s Gremlin API, exposing a master key that could access any Cosmos DB account. Microsoft fixed it, with no customer impact found. byWaqasJuly 30, 20263 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening Microsoft has fixed a critical vulnerability in Azure Cosmos DB that could have allowed an attacker to locate and take control of databases belonging to any customer. Wiz Research named the flaw CosmosEscape and said it also placed databases used internally by Microsoft services within reach. The vulnerability was found in the Gremlin API, an interface used to work with graph databases, where information is stored as connected items and relationships. A malicious user needed an Azure Cosmos DB account of their own, but did not need access to the organization they intended to target. According to Wiz’s findings shared with Hackread.com, a specially prepared Gremlin query could break out of the restricted environment processing it and run commands on Microsoft’s backend systems. From there, the researchers obtained a platform secret they named the “Cosmos Master Key.” Master Key Opened Two Paths to Customer Data Possession of that secret provided two separate capabilities. The first allowed the holder to request the primary key for any Cosmos DB account, giving full permission to read and change data stored in that account. The second allowed databases hosted by the service to be listed and searched using identifiers such as an Azure tenant ID or subscription ID. An attacker could therefore identify databases belonging to a chosen company and then retrieve the keys needed to access them. Wiz said the method worked regardless of the database’s region or supported API type and included private databases. Wiz tested the exploit through publicly accessible service endpoints, without compromising the target’s Azure account first. Microsoft Services Also Use Cosmos DB Cosmos DB supports applications that need fast access to data in multiple geographic regions. Microsoft also uses it behind services including Entra ID, Teams and Copilot, meaning databases associated with those products could have been identified and accessed through the same weakness, according to Wiz. This does not mean customer or Microsoft databases were breached. Wiz described the result of controlled security research, while Microsoft told Reuters that the problem had been fully addressed and that its investigation found no evidence of customer impact. The flaw affected the service itself, so customers could not have fixed it by changing their own application code or Azure settings. The central role of the master key also meant one successful attack could have crossed the normal separation between different customers and Microsoft’s internal services. “This discovery underscores the value of cloud security research, particularly as the rise of AI is accelerating the pace and sophistication of vulnerability discovery, making attack surface management more critical than ever,” said Robert Costello, Chief Digital and Information Officer at Merlin Group. “Wiz identified and responsibly disclosed a high-impact vulnerability, allowing time to remediate before it could be broadly exploited. The complexity of this flaw, and its potential to expose every Cosmos DB instance, is a reminder that even the largest cloud providers must constantly test their own environments. This demonstrates why continuous cloud posture visibility and close vendor collaboration are essential to protecting modern cloud environments,“ Robert emphasized. Microsoft Removes the Cosmos Master Key After receiving the report, Microsoft removed the platform-wide Cosmos Master Key and introduced additional controls intended to stop similar access from the Gremlin processing environment. Microsoft handled the remediation within its managed Azure infrastructure. The company’s removal of the shared secret addresses more than the specific query used by Wiz. It also removes the mechanism that allowed one backend credential to retrieve account keys and search database information throughout the service. CosmosEscape follows Wiz’s 2021 disclosure of ChaosDB, a separate Cosmos DB vulnerability involving the service’s Jupyter Notebook feature. That earlier flaw could also have exposed customer database keys, although the two findings used different entry points. Nevertheless, organizations using Cosmos DB should still review account activity, key access, and unexpected database operations as part of normal monitoring. Microsoft’s statement that it found no customer impact means there is currently no evidence that attackers used CosmosEscape outside Wiz’s testing. Waqas I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cybersecurity and tech world. I am also into gaming, reading and investigative journalism. View Posts AzureAzure Cosmos DBCosmos DBCosmosEscapeCybersecuritydatabaseMicrosoftVulnerability Leave a Reply Cancel reply View Comments (0) Related Posts Read More Security Scams and Fraud Fake Empire Podcast Invites Target Crypto Industry with macOS AMOS Stealer Hackers are posing as Empire podcast hosts, tricking crypto influencers and developers with fake interview invites to deliver macOS AMOS Stealer malware. byMauro Eldritch Read More Security Cyber Attacks News Anonymous Sudan Claims DDOS Attacks on UAE’s Flydubai Airline Anonymous Sudan alleges that the cyber attack they conducted has crippled the reservation system and other online assets of the targeted entity. byWaqas Read More Security Auth Bypass Flaw in Service Finder WordPress Plugin Under Active Exploit An Authentication Bypass (CVE-2025-5947) in Service Finder Bookings plugin allows any unauthenticated attacker to log in as an administrator. Over 13,800 exploit attempts detected. Update to v6.1 immediately. byDeeba Ahmed Read More Security Data Breaches Leaks Privacy Exposed Cloud Server Tracks 800,000 Volkswagen, Audi, and Skoda EVs SUMMARY A recent report from the German news outlet Spiegel has revealed a significant security breach impacting hundreds… byDeeba Ahmed

Entities