An alarming security flaw in Microsoft’s Azure Cosmos DB was uncovered by cybersecurity firm Wiz, revealing a potential threat to all databases within the service. This vulnerability, termed ‘CosmosEscape,’ could have granted attackers full access to any database by exploiting a platform-wide key.
Security Flaw Details
The CosmosEscape flaw allowed malicious actors to retrieve the primary key of any Cosmos DB account, enabling comprehensive read and write access. With these privileges, attackers could list and filter databases by organizational identifiers such as subscription and tenant IDs. This capability posed a significant risk, allowing for targeted attacks on specific organizations.
Wiz highlighted that the issue was serious due to Microsoft’s integration of Cosmos DB across services like Entra ID, Teams, and Copilot. This integration could have exposed sensitive data to unauthorized access if the vulnerability was exploited.
Exploiting the Gremlin API
The vulnerability was linked to the Gremlin API, a popular graph query language. The API relies on a custom engine that compiles queries into .NET code. Although restrictions were in place to prevent unauthorized access, Wiz found that .NET reflection could bypass these, allowing arbitrary code execution.
This discovery enabled Wiz to gain code execution on the DB Gateway, a service operating on multi-tenant clusters. The gateway used a signing key for accessing customer accounts’ primary keys, which was effective across various scopes including tenants and APIs.
Microsoft’s Response and Mitigation
Upon detecting the flaw, Wiz reported it to Microsoft in November 2025. The tech giant swiftly implemented a hotfix within two days to mitigate the vulnerability. By July, Microsoft had completed a long-term architectural update across all regions to enhance security.
Microsoft assured that extensive log reviews showed no unauthorized access beyond the controlled testing by researchers. Consequently, no customer data was compromised, and no further action is required by users. This response underscores the importance of rapid detection and remediation in cloud security.
This incident highlights the critical need for robust cybersecurity measures in cloud services, especially those holding vast amounts of sensitive data. As cloud technology continues to evolve, ongoing vigilance and proactive security updates remain paramount to safeguarding user data.
