A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service’s Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz.
Wiz, which codenamed the chain CosmosEscape, said the exploit chain began with a crafted query against a Gremlin database controlled by the attacker. From there, code execution on a multi-tenant gateway exposed a platform-wide signing secret and a regional account directory, allowing the researchers to locate a target and retrieve its primary account key.
Microsoft blocked the vulnerable Gremlin entry point within 48 hours of the November 2025 report. Wiz said Microsoft completed the longer-term fix across all regions in July 2026 and eliminated the platform-wide key.
Microsoft said its review found no unauthorized activity outside the researchers’ testing. It said no customer data was accessed and no customer action is required.
The Hacker News has reached out to Microsoft for confirmation of the affected scope and log-review period, and to Wiz for clarification of the exploit prerequisites and tested scope. This story will be updated with any response.
The published chain starts with a Gremlin database controlled by the attacker and credentials for that account, not access to a victim database.
Microsoft’s current connection guide requires an account host, database, and graph path, and primary key before a client can submit Gremlin queries. Wiz has not published whether the exploit required anything beyond that starting point.
According to Wiz’s technical write-up, Cosmos DB’s custom Gremlin engine translates Gremlin queries into .NET code and runs them inside a restricted environment. Wiz said the restrictions failed to account for .NET reflection, allowing the researchers to build file-read and file-write primitives before reaching arbitrary code execution.
The public disclosure shows the output of a crafted query that executed the hostname command on the Cosmos DB backend, but not the query itself. The researchers said they will present the complete chain at a Black Hat USA briefing on August 6.
The code execution landed on a component Wiz calls the DB Gateway, which executes customer queries on multi-tenant Azure Service Fabric clusters. Customer databases were not stored on those clusters, but the gateway could retrieve the primary key for a requested Cosmos DB account. Microsoft documentation says a Cosmos DB account primary key grants full control over all resources in that account.
Credentials available to the gateway also provided access to a signing key that Wiz dubbed the Cosmos Master Key. Wiz said the gateway’s signing key could retrieve the primary key for any account across tenants, regions, and the SQL, MongoDB, Cassandra, and Gremlin APIs.
The same secret opened a regional database called the Config Store, described by Wiz as a directory containing Cosmos DB account names, subscription and tenant identifiers, network settings, and tags. An attacker could use it to find a specific organization’s accounts and then request their primary keys.
Wiz said the chain could also reach private and network-isolated accounts because the compromised gateway enforced those network boundaries from inside the service. The researchers’ write access to the Config Store suggested network settings could also be changed, although the report does not say they demonstrated that against another customer’s account.
Microsoft documentation says Teams message data remains in Cosmos DB, while a Microsoft engineering post says Copilot stores users’ queries and conversation histories there. Wiz said databases supporting those products were potentially accessible, but it did not report accessing their data.
The public record does not say when the vulnerable engine and signing-key path entered production or what period Microsoft’s log review covered. The duration of potential exposure therefore remains unknown, although the known path has since been closed.
The disclosure lists no CVE identifier or severity score. CosmosEscape is technically separate from the ChaosDB and CosMiss flaws disclosed in 2021 and 2022, which involved Cosmos DB’s Jupyter Notebook feature.
