Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover
Microsoft patches CosmosEscape vulnerability in Azure Cosmos DB Gremlin API exposing master key.
Wiz researchers discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API that allowed attackers with their own Azure account to extract a platform-wide master key and gain unauthorized access to any customer's database. The flaw enabled attackers to list and retrieve primary keys for any Cosmos DB instance, including those used by Microsoft services like Teams and Entra ID. Microsoft has patched the vulnerability with no evidence of exploitation found.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CosmosEscape vulnerability exposed a fundamental access control failure in Azure Cosmos DB's Gremlin API, where any authenticated Azure tenant could extract a platform-wide master key granting unauthorized access to any customer's database. This is a classic example of broken tenant isolation — a single compromised or malicious account could have triggered a catastrophic cross-customer data breach affecting high-profile services like Microsoft Teams and Entra ID. The flaw highlights how privileged internal keys must never be reachable from tenant-level API surfaces, regardless of authentication state. Cloud providers bear a shared responsibility to enforce strict privilege boundaries, and this case underscores why proactive third-party security research is critical to catching systemic cloud flaws before malicious actors do.
What helps against this
How we list vendors
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.