Reported by 1 outlet

Timeline

1. original reporting

   CosmosEscape: Critical Azure Cosmos DB Flaw Could Have Compromised Every Database on the Service

   securityweek.com · 75d ago · July 31st, 2026

   Wiz disclosed a critical vulnerability in Azure Cosmos DB — dubbed CosmosEscape — that could have allowed an attacker to retrieve the primary key of any Cosmos DB account on the platform and gain full read/write access across the service, including Microsoft's own databases.

   Attack chain:

   • Exploited via the Gremlin API: the custom Gremlin engine compiles queries into .NET code run in a sandbox; the sandbox did not block .NET reflection, which Wiz used to build arbitrary code execution primitives

   • Achieved code execution on the DB Gateway (multi-tenant Service Fabric clusters that execute customer queries)

   • The gateway used a platform-wide signing key to fetch customer account primary keys — valid across tenants, regions, and APIs ("Cosmos Master Key")

   • With the master key, researchers could query the Config Store (itself a Cosmos DB) to enumerate every account on the service and filter by subscription/tenant ID — "precision targeting at platform scale"

   • Works against private and network-isolated Cosmos DB accounts as well

   Exposure context: Microsoft uses Cosmos DB to store data for Entra ID, Teams, and Copilot. Wiz reported the flaw in November 2025; Microsoft deployed a hotfix within two days and completed a long-term architectural fix across all regions in July 2026. Microsoft reviewed access logs and found no evidence of unauthorized activity or customer data access — no customer action required.

   Hunting hypothesis: For Cosmos DB environments that predate July 2026, review gateway access logs for anomalous Gremlin API query patterns and unexpected primary-key retrieval calls.