A vulnerability in Azure Cosmos DB, now resolved, could have allowed attackers to gain full read and write access to databases across different customer tenants. The flaw, identified by security firm Wiz and dubbed 'CosmosEscape', involved a crafted query against a Gremlin database controlled by the attacker. This exploit chain enabled code execution on a multi-tenant gateway, exposing a platform-wide signing secret and a regional account directory.
Microsoft acted swiftly, blocking the vulnerable Gremlin entry point within 48 hours of being notified in November 2025, and implemented a comprehensive fix across all regions by July 2026. The company stated that their investigation found no evidence of unauthorized data access or customer impact. Therefore, no customer actions are deemed necessary at this time.
The exploit began with a Gremlin database under the attacker's control, exploiting Cosmos DB's custom Gremlin engine that translates Gremlin queries into .NET code. This flaw allowed the attackers to execute arbitrary code by bypassing the restricted environment. The compromised component, named the DB Gateway by Wiz, executed customer queries across multi-tenant Azure Service Fabric clusters, enabling the retrieval of primary keys for requested Cosmos DB accounts.
Wiz discovered that credentials available to the gateway could access a signing key, termed the Cosmos Master Key, which could retrieve primary keys across various APIs and regions. Furthermore, a regional database called the Config Store, containing account information and network settings, was also accessible. Despite the vulnerability's potential, Microsoft confirmed that no unauthorized activity occurred, and the issue has been fully addressed.