CosmosEscape: An Azure Cosmos DB Flaw Opened the Door to Every Customer's Databases

Wiz has disclosed an already-patched vulnerability in Azure Cosmos DB that could in theory have let an attacker break out of the Gremlin query sandbox and gain full read and write access to the databases of other cloud customers. The researchers named the exploitation chain CosmosEscape.

How the attack worked

The starting point was a Gremlin database under the attacker's control, along with credentials to it. Cosmos DB's own engine translates Gremlin queries into .NET code and executes it in a restricted environment. According to Wiz, those restrictions did not account for .NET's reflection mechanism — through it the researchers built file read and write primitives and then achieved arbitrary code execution. The public report shows only the output of a hostname command run on the backend; the query itself the authors have promised to present at a Black Hat USA briefing on August 6.

Code execution took place on a component Wiz calls the DB Gateway, which handles client requests on multi-tenant Azure Service Fabric clusters. The databases themselves are not stored there, but the gateway could retrieve the primary key of the requested Cosmos DB account — and such a key, per Microsoft's documentation, grants full control over all of its resources.

The platform key

The most serious part: the accessible gateway knew a signing key that the researchers dubbed the Cosmos Master Key. With it, one could obtain the primary key of any account in any tenant and region, regardless of the API in use — SQL, MongoDB, Cassandra or Gremlin. The same secret unlocked the regional Config Store catalog with account names, subscription and tenant identifiers, network settings and tags. Through it an attacker could find a specific organization's accounts and request their keys.

Because the compromised gateway applied network restrictions from inside the service, the chain could reach even private, network-isolated accounts. Write access to the Config Store hinted at the ability to change network settings, although the report contains no demonstration against someone else's account.

Wiz notes that the databases serving Microsoft Teams and Copilot, which store data in Cosmos DB, were also potentially reachable — but the researchers did not claim access to that data.

Microsoft's response

Microsoft blocked the vulnerable Gremlin entry point within 48 hours of being notified in November 2025, and completed the full fix across all regions, together with the removal of the platform key, in July 2026. Its investigation found no unauthorized activity beyond the researchers' tests, no access to customer data occurred, and no action is required from customers.

The window of potential exposure remains unknown: it is unclear when the vulnerable engine reached production and what span the log review covered. CosmosEscape has no CVE identifier and no severity score. Technically the chain is unrelated to the ChaosDB and CosMiss vulnerabilities of 2021–2022, which concerned the Jupyter Notebook feature in Cosmos DB.

Source: The Hacker News