A significant security flaw in Azure Cosmos DB, identified by cybersecurity firm Wiz, has raised concerns about data safety. The vulnerability, known as CosmosEscape, allowed attackers to access a platform-wide key, giving them the ability to retrieve primary keys for any Cosmos DB account. This access granted full read and write capabilities across the service, posing a substantial risk to data integrity and confidentiality.
The flaw could be exploited via the Gremlin API, a graph query language that relies on a custom engine to execute queries. Although designed to restrict access beyond Gremlin operations, the engine was vulnerable to .NET reflection, enabling arbitrary code execution. Wiz's researchers discovered that the DB Gateway used a signing key to obtain customer account keys, which worked across different tenants, regions, and APIs. This key, termed the Cosmos Master Key, could access a configuration store containing detailed information on every Cosmos DB account.
Microsoft was alerted to the vulnerability in November 2025 and quickly deployed a hotfix within two days. By July, a comprehensive long-term fix was implemented across all regions. The tech giant conducted thorough access log reviews and found no evidence of unauthorized access beyond the researcher's tests. Consequently, Microsoft stated that no customer action is required.