A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz.
Wiz, which codenamed the chain CosmosEscape, said the exploit chain began with a crafted query against a Gremlin database controlled by the attacker. From there, code execution on a multi-tenant gateway exposed a platform-wide signing secret and a regional account directory, allowing the researchers to locate a target and retrieve its primary account key.
Microsoft blocked the vulnerable Gremlin entry point within 48 hours of the November 2025 report. Wiz said Microsoft completed the longer-term fix across all regions in July 2026 and eliminated the platform-wide key.
"We appreciate Wiz's work in identifying and reporting this issue through coordinated vulnerability disclosure," a Microsoft spokesperson told The Hacker News. "We have fully addressed the issue and found no evidence of customer impact based on our investigations. We continue to invest in additional security enhancements across the platform."
Microsoft said its review found no unauthorized activity outside the researchers' testing. It said no customer data was accessed and no customer action is required.
Wiz told The Hacker News that the only prerequisite was a standard Azure account with a Cosmos DB Gremlin database controlled by the attacker, which could be created in minutes. No special permissions, insider access, or prior foothold were required, and the exploit ran through the attacker's own database query interface.
Wiz said the query returned the platform-wide master key. An attacker could then discard the original database and Azure account and use the key over Cosmos DB's public endpoint to retrieve a target account's primary key and take control of its databases.
According to Wiz's technical write-up, Cosmos DB's custom Gremlin engine translates Gremlin queries into .NET code and runs them inside a restricted environment. Wiz said the restrictions failed to account for .NET reflection, allowing the researchers to build file-read and file-write primitives before reaching arbitrary code execution.
The public disclosure shows the output of a crafted query that executed the hostname command on the Cosmos DB backend, but not the query itself. The researchers said they will present the complete chain at a Black Hat USA briefing on August 6.
The code execution landed on a component Wiz calls the DB Gateway, which executes customer queries on multi-tenant Azure Service Fabric clusters. Customer databases were not stored on those clusters, but the gateway could retrieve the primary key for a requested Cosmos DB account. Microsoft documentation says a Cosmos DB account primary key grants full control over all resources in that account.
Credentials available to the gateway also provided access to a signing key that Wiz dubbed the Cosmos Master Key. Wiz told The Hacker News that it tested the key against every Cosmos DB API flavor and across several regions, and that it unlocked every account tested. The signing key could retrieve the primary key for accounts across tenants, regions, and the SQL, MongoDB, Cassandra, and Gremlin APIs.
The same secret opened a regional database called the Config Store, described by Wiz as a directory containing Cosmos DB account names, subscription and tenant identifiers, network settings, and tags. An attacker could use it to find a specific organization's accounts and then request their primary keys. Wiz told The Hacker News that it ran a count query through the Config Store and verified that one tenant in one region contained thousands of Microsoft-internal databases. It said any broader access described in the report reflected what the key made possible, not actions the researchers took.
Wiz said the chain could also reach private and network-isolated accounts because the compromised gateway enforced those network boundaries from inside the service. The researchers' write access to the Config Store suggested network settings could also be changed, although the report does not say they demonstrated that against another customer's account.
Microsoft documentation says Teams message data remains in Cosmos DB, while a Microsoft engineering post says Copilot stores users' queries and conversation histories there. Wiz said databases supporting those products were potentially accessible, but it did not report accessing their data.
The public record does not say when the vulnerable engine and signing-key path entered production or what period Microsoft's log review covered. The duration of potential exposure therefore remains unknown, although the known path has since been closed.
The disclosure lists no CVE identifier or severity score. CosmosEscape is technically separate from the ChaosDB and CosMiss flaws disclosed in 2021 and 2022, which involved Cosmos DB's Jupyter Notebook feature.
Update [July 31, 2026]: This story has been updated to include comments from Wiz on the exploit prerequisites, tested scope, and access to Microsoft-internal database records.
