Wiz researchers demonstrated a chain of flaws in Azure Cosmos DB’s Gremlin query engine that could have given one Azure customer full read and write access to databases inside other customers’ tenants. The research, codenamed CosmosEscape, exposed a platform-wide signing key and a regional account directory, and Microsoft has now confirmed it closed the underlying issues with no evidence of customer impact.
CosmosEscape: Escaping the Gremlin Query Sandbox to Reach the Database Gateway
The only prerequisite was a standard Azure account with a Cosmos DB Gremlin database controlled by the attacker, which Wiz said could be created in minutes with no special permissions, insider access, or prior foothold. Cosmos DB’s custom Gremlin engine translates Gremlin queries into .NET code that runs inside a restricted environment, and Wiz found those restrictions did not account for .NET reflection. That allowed the researchers to build file-read and file-write primitives and then reach arbitrary code execution on the multi-tenant database gateway.
The Cosmos Master Key Unlocked Every Account Wiz Tested
Credentials on the compromised gateway exposed a signing key Wiz dubbed the Cosmos Master Key. The researchers tested it against every Cosmos DB API flavor and across several regions, and it unlocked every account they tested. One tenant in one region alone contained thousands of Microsoft-internal databases, according to the report.
The Config Store Directory Could Pinpoint Any Tenant’s Primary Keys
The same secret opened a regional database the researchers called the Config Store, a directory of Cosmos DB account names, subscription and tenant IDs, network settings, and tags. That let an attacker locate a specific organization’s accounts and request their primary account keys, which grant full control over every resource in the account. Wiz also found the chain could reach private and network-isolated accounts because the compromised gateway enforced those network boundaries from inside the service.
A Cosmos DB account primary key grants full control over all resources in that account. Microsoft documentation confirms that Teams message data and Microsoft Copilot user queries and conversation histories are stored in Cosmos DB, though Wiz did not access them.
Microsoft’s Two-Stage Response and the No-Customer-Impact Finding
Microsoft blocked the vulnerable Gremlin entry point within 48 hours of Wiz reporting the chain in November 2025, and it completed the longer-term fix across all regions in July 2026, eliminating the platform-wide key. In a statement, Microsoft said the issue was fully addressed and that its investigations found no evidence of customer impact or of unauthorized activity beyond the researchers’ testing. No customer action is required. No CVE identifier or severity score has been assigned to the finding.
CosmosEscape’s Place in Cosmos DB Research History
Wiz distinguishes CosmosEscape from the ChaosDB and CosMiss flaws disclosed in 2021 and 2022, which involved Cosmos DB’s Jupyter Notebook feature. The company nonetheless draws a comparison to the 2021 ChaosDB vulnerability on severity grounds, noting that exposure of a platform-wide signing key plus an account directory is comparable in impact and that ChaosDB later drew regulatory scrutiny. Wiz plans to present the complete chain at an upcoming Black Hat USA briefing.
Why a Signing Key Becomes a Multi-Tenant Risk
The severity of the finding rests on the combination of two elements: a single signing secret that validated requests across tenants, regions, and API flavors, and a directory that let an attacker map the service and pick a specific target. On their own, each would limit the reach of an exploit; together they turned a sandbox escape into a cross-tenant credential compromise. The design of the Config Store, holding account metadata for regional tenants in one queryable database, is the kind of aggregation point that defenders at cloud providers now treat as a crown-jewel asset.
Defensive Guidance for Cosmos DB Tenants
Organizations using Cosmos DB should follow Microsoft’s security guidance and monitor for unusual key activity, even though the company has stated no customer action is required. A primary account key is effectively root access to the data stored in a Cosmos DB account, including chat histories and collaboration content in the case of Microsoft’s own products. Rotation of account keys after a security event, least-privilege scoping of who holds those keys, and attention to where tenant metadata is aggregated remain baseline practices for cloud database estates.
