A critical vulnerability in Microsoft Azure's Cosmos DB database service could have allowed attackers to break out of security boundaries, run code on shared infrastructure, and gain access to any customer's database—including data stores used by Microsoft's own Entra ID, Teams, and Copilot services—according to research published by cloud security firm Wiz. The flaw, which Wiz named CosmosEscape, depended on a series of linked weaknesses that let researchers obtain what they described as the "Cosmos Master Key," a platform-wide credential capable of pulling the primary key for any Azure Cosmos DB account. Microsoft has since fully fixed the issue, and the company says its investigation found no evidence of unauthorized activity beyond the researchers' testing.
The attack began in the Gremlin API, one of several query interfaces that Azure Cosmos DB supports. Wiz researchers Yuval Avrahami and Lior Maman discovered they could exploit insufficient restrictions around .NET reflection to escape the Gremlin sandbox and achieve arbitrary code execution on the Cosmos DB Database Gateway, the service responsible for running customer queries. That access exposed credentials capable of retrieving the primary key for any Cosmos DB account, not just the researchers' own database. The same platform credential also unlocked Cosmos DB's regional configuration store, allowing attackers to list database accounts by tenant or subscription ID before pulling their primary keys. The exploit chain affected more than just customer workloads—databases supporting Microsoft Entra ID, Teams, and Copilot were also potentially accessible, and even private and network-isolated Cosmos DB deployments were exposed because the compromised Database Gateway was responsible for enforcing those network boundaries.
"Chained together, these capabilities could have enabled precision targeting at platform scale: from identifying a specific organization's databases to compromising them, all from publicly accessible endpoints," Avrahami and Maman wrote. The researchers found the signing key wasn't limited to a single account—it worked across tenants, regions, and even different API types including SQL, MongoDB, Cassandra, and Gremlin, according to Wiz. The firm privately disclosed the vulnerability to Microsoft on Nov. 20, 2025, and Microsoft blocked the vulnerable Gremlin attack path within 48 hours before completing a broader architectural redesign across all Azure regions in July 2026. Microsoft also eliminated the platform-wide authentication mechanism Wiz dubbed the "Cosmos Master Key," and the company said no customer data was accessed and no customer action is required.
The disclosure highlights risks that exist below the security controls cloud customers typically manage themselves, said Sakshi Grover, senior research manager at IDC. Rather than evaluating managed database services primarily on features such as encryption, private networking, or identity controls, enterprises should examine how providers isolate tenant-controlled execution from privileged service components, scope internal credentials, and contain the impact if shared infrastructure is compromised, Grover said. Organizations using the Cosmos DB Gremlin API should review available logs, determine whether sensitive workloads were affected, and seek additional assurance from Microsoft where regulatory or compliance requirements demand it, she added. The incident should also prompt organizations to reduce long-term reliance on static database account keys by adopting managed identities, fine-grained role-based access controls, and client-side encryption where practical. Hyperscale services often depend on privileged gateways, control planes, metadata stores, and service identities that operate across large numbers of customers, and whenever tenant-controlled input is processed close to those components, a vulnerability can cross what appeared to be separate security boundaries and create platform-scale consequences, Grover said. For organizations running sensitive workloads on shared cloud infrastructure, the lesson is that architectural assumptions about tenant boundaries deserve scrutiny even when providers operate at enterprise scale. The speed of Microsoft's response demonstrates that major cloud vendors can act decisively when researchers surface cross-tenant exposure, but the scope of potential access underscores that isolation failures at the platform layer carry fundamentally different risk than application-level bugs.