- Wiz Research discovered a critical vulnerability in Azure Cosmos DB's Gremlin API, named CosmosEscape, that could allow attackers to compromise all databases in the service, including Microsoft's internal databases.
- The vulnerability enabled attackers to retrieve a platform-wide secret called the Cosmos Master Key, granting full read/write access to any Cosmos DB account and the ability to enumerate all databases by subscription or tenant ID.
- Cosmos DB is used internally by Microsoft services like Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot, making them potentially accessible via this vulnerability.
- Microsoft has fully remediated the issue by eliminating the Cosmos Master Key and introducing new guardrails, with no customer action required.
- The vulnerability was exploited by bypassing the Gremlin sandbox through .NET reflection, allowing arbitrary code execution on the DB Gateway, which then used the master key to access other accounts.
- The attack chain involved querying the Config Store to enumerate accounts and using the master key to retrieve primary keys, affecting both customer and Microsoft internal databases, including network-isolated accounts.
- Microsoft deployed a hot fix within 48 hours and completed a long-term architectural fix by July 2026, with no evidence of exploitation beyond the research.