Vulnerabilities · 45 days ago
A single Gremlin bug did not just touch one database. It let a shared Cosmos DB gateway expose a platform signing secret, so a tenant-scoped query path could be turned into a key oracle for other customers' databases. That is the failure mode here: the service boundary, not the tenant boundary, broke.
Wiz says a crafted Gremlin query escaped the .NET sandbox through reflection and reached the gateway's own signing material. From there, the researchers could pull primary keys for Cosmos DB accounts and enumerate databases across tenants, including internal Microsoft workloads that also use Cosmos DB. Microsoft says it has fully remediated the issue and found no evidence of abuse beyond the research.
For operators, the risk is not one leaked database key. It is a shared control plane that can reveal keys for many databases at once, which turns a multi-tenant query layer into a cross-tenant access path.
3 sources covering this story
Critical Flaw Allowed to Azure Cosmos DB Pwnage
Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access.
Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database
Azure Cosmos DB's Gremlin flaw let Wiz escape the sandbox and retrieve an account key.
CosmosEscape: Taking Over Every Azure Cosmos DB | Wiz Blog
Wiz Research details CosmosEscape, a critical vulnerability in Azure Cosmos DB that granted full read/write access to every database.
Part of the PlainSec briefing for 2026-08-01