Cloud security firm Wiz says it found a way to reach into every database hosted on Azure Cosmos DB, Microsoft's flagship cloud database service, using nothing more than a specially crafted query run against its own test account. Microsoft has fixed the flaw, which Wiz named CosmosEscape, and says no customer data was accessed.
The stakes were unusually high because Cosmos DB is not just a product Microsoft sells. It is plumbing that Microsoft's own services run on, including Microsoft Entra ID, Microsoft Teams and Microsoft Copilot. A weakness at that layer reaches upward into everything built on top of it.
What went wrong
Cosmos DB lets customers query data in several languages, one of which is Gremlin, used for graph data. Wiz noticed Microsoft had built a custom Gremlin engine that compiles customer queries into .NET code and runs them inside a sandbox, a walled off area meant to stop a query doing anything beyond database work. The wall had a gap. The restrictions did not properly account for .NET reflection, a feature that lets code inspect and invoke other code at runtime, and Wiz used it to read files, write files and eventually run arbitrary commands on the machine handling the query.
That machine, the DB Gateway, executes customer queries on their behalf on shared multi-tenant clusters. To reach a customer's data it uses that account's primary key, the credential granting full read and write access. Wiz found the signing key the gateway used to fetch those keys was not scoped to a single account. It worked across tenants, across regions, and across every Cosmos DB interface: SQL, MongoDB, Cassandra and Gremlin. The researchers dubbed it the Cosmos Master Key.
Why it mattered
The master key also unlocked the Config Store, a regional registry of every Cosmos DB account holding names, subscription IDs, tenant IDs, network settings and tags. Chained together, the two gave an attacker a targeting system: enumerate every account in a region, filter by tenant ID to find one specific organization, then retrieve that organization's primary key and read or alter its data, all from publicly reachable endpoints. Private and network isolated accounts were not safe either, because the gateway is the component that enforces that isolation in the first place.
What you should do
Nothing. Microsoft has fully remediated the issue, eliminated the Cosmos Master Key and added new guardrails to the service. Its review of access logs found no unauthorized activity outside the researchers' own testing, and no customer action is required.
The findings come from Yuval Avrahami, Sagi Tzadik, Nir Ohfeld, Ronen Shustin, Hillai Ben-Sasson and Noam Malron of the Wiz Research team, who reported the flaw to Microsoft on 20 November 2025 and published the original report on 30 July 2026, once the long term architectural fix had rolled out to all regions. Microsoft acknowledged the report the same day it arrived and deployed a hot fix within 48 hours. Wiz says an early version of its AI vulnerability researcher, Atlas, assisted the work, and the team will present the full exploitation chain at Black Hat USA.
It is the second Wiz finding in a week to hinge on weak boundaries around cloud and AI infrastructure, following the firm's survey of Fortune 500 companies leaving AI connector servers open to anyone. Broken tenant separation has been a running theme this month, including Kubernetes storage flaws that let one tenant read another tenant's files.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.