Thought Leadership
A vulnerability chain in Azure Cosmos DB could have given attackers read and write access to databases of the cloud service.
The starting point of the attack chain, dubbed CosmosEscape, was the graph database query language Gremlin, one of several interfaces of Azure Cosmos DB. While testing Gremlin queries, the Wiz researchers ran into unusual .NET exception messages, a sign that Cosmos DB translates Gremlin queries internally into its own .NET code and executes them in a restricted environment.
The restrictions put in place for this, however, did not sufficiently account for so-called .NET reflection techniques, allowing the researchers to achieve file read and write access and ultimately arbitrary code execution through their own database queries. According to Wiz, the only prerequisite for the attack was an ordinary Azure account, created in a few minutes, with its own Cosmos DB Gremlin database, no special permissions or prior access to third-party systems were required.
A key to the entire Azure platform
Through this escape, the researchers achieved code execution on the so-called DB Gateway, a service that runs customer queries on shared Service Fabric clusters. There, they found credentials for a signing key that Wiz calls the Cosmos Master Key. This key was not limited to a single customer account, but worked platform-wide across all tenants, regions, and supported API variants such as SQL, MongoDB, Cassandra, and Gremlin, and could retrieve the primary key of any Cosmos DB account through publicly accessible endpoints.
In addition, the Master Key granted access to the so-called Config Store, a regional directory of all Cosmos DB accounts containing account names, subscription and tenant IDs, and network settings. Since the Config Store was itself queryable as a Cosmos DB database, it could be used to list all accounts in a region or filter them by a specific organization. Combined, attackers could have used this to specifically identify the databases of a particular organization and then fully take them over via the Master Key, even in the case of otherwise private and network-isolated accounts.
Fast initial response, months-long architecture overhaul
Wiz reported the vulnerability to Microsoft on November 20, 2025. Just two days later, on November 22, Microsoft deployed a hotfix that blocked the affected entry point in the Gremlin API. According to the company, Microsoft completed the full, more far-reaching architectural overhaul across all Azure regions in July 2026, during which the platform-wide Master Key was completely removed. Microsoft also strengthened authentication between individual services and introduced additional network protections as well as further monitoring and detection capabilities.
Microsoft stated that, following an extensive review of access logs, it found no evidence of unauthorized use of the vulnerability beyond the researchers’ testing activity. No customer data was affected, and no further action is required from customers. CosmosEscape is not the first vulnerability in Azure Cosmos DB discovered by Wiz: back in 2021, the company disclosed a different vulnerability, ChaosDB, that could be exploited via the service’s Jupyter Notebook feature.
(red)
