Azure Cosmos DB Flaw Exposed Master Key to Any Customer Database

A now-patched vulnerability in Microsoft Azure Cosmos DB could have granted attackers full read and write access to databases across customer tenants, according to cloud security researchers at Wiz. The exploit chain, codenamed CosmosEscape, began with a crafted query against a Gremlin database controlled by the attacker and ultimately exposed a platform-wide signing secret capable of unlocking any Cosmos DB account on the service.

Wiz's technical write-up revealed that Cosmos DB's custom Gremlin engine translates queries into .NET code executed inside a restricted sandbox. The researchers found that these restrictions failed to account for .NET reflection, enabling them to construct file-read and file-write primitives before achieving arbitrary code execution on a component Wiz calls the DB Gateway. Running on multi-tenant Azure Service Fabric clusters, the gateway provided access to the "Cosmos Master Key"—a platform-wide signing secret—and a regional account directory. With these, the researchers could locate a target Cosmos DB account and retrieve its primary account key, which Microsoft documentation states grants full control over every resource within that account. The full chain will be presented at the Black Hat USA briefing on August 6.

Microsoft acknowledged the report and moved quickly, blocking the vulnerable Gremlin entry point within 48 hours of the November 2025 disclosure. A longer-term fix was completed across all regions in July 2026, and the company confirmed it had eliminated the platform-wide key entirely. "We have fully addressed the issue and found no evidence of customer impact based on our investigations," a Microsoft spokesperson said, stressing that no customer action is required and that no unauthorized activity outside the researchers' testing was detected.

For organizations running workloads on Azure—or any cloud platform—this incident underscores the importance of layered defense. Security teams should validate encryption hygiene with an SSL/TLS checker, audit exposed infrastructure with a port scanner, and verify account-key strength using a password checker to ensure primary keys meet modern complexity standards and are rotated regularly.