CosmosEscape: how Wiz extracted the master key for every Azure Cosmos DB database
Wiz Research disclosed CosmosEscape this week: a vulnerability chain in Azure Cosmos DB that exposed a platform-wide signing key, enabling full read and write access to every Cosmos DB database on Azure. Microsoft patched it. No customer action is required. But the disclosure is worth understanding in detail because the attack pattern it reveals is not unique to Cosmos DB.
How the attack worked
The entry point was an attacker-controlled Gremlin database. Gremlin is a graph query language supported by Azure Cosmos DB. Wiz researchers crafted a specific query against their own Cosmos DB Gremlin database.
The crafted query triggered code execution on a shared multi-tenant gateway. That gateway handled requests for multiple Azure customers and held infrastructure-level secrets to do so.
From code execution on the gateway, researchers extracted two pieces of information: a platform-wide signing secret, and a regional account directory. The signing secret had scope across the entire platform, not scoped to a single customer or tenant.
With the signing secret and the account directory, researchers could compute the primary key for any Cosmos DB account in the region. The primary key grants full read and write access to that account's data.
In practice: a crafted Gremlin query against an attacker's own database gave access to every other customer's data on the platform.
The timeline
Wiz reported CosmosEscape to Microsoft on November 20, 2025. Microsoft acknowledged receipt the same day. Within 48 hours, Microsoft deployed a hotfix that blocked the vulnerable Gremlin API entry point. That removed the immediate exploitation path.
The longer architectural fix, re-scoping secrets so a gateway compromise cannot expose platform-wide credentials, took longer. Microsoft completed the architectural remediation and rolled it out across all Azure regions in July 2026. Wiz published the full disclosure alongside the architectural fix.
Wiz's Atlas AI system, a vulnerability research tool Wiz launched publicly on July 27, 2026, assisted in discovering the vulnerability chain.
What the fix required
The hotfix removed the exploitation path. But it did not address the underlying architectural problem: a shared gateway holding a secret with platform-wide scope.
The full architectural fix required changing how secrets were scoped. Platform-wide secrets needed to become per-account or per-region secrets, so that a gateway compromise could not expose credentials for other customers. This is a non-trivial architectural change in a global cloud service.
Microsoft found no evidence of unauthorized access to customer data beyond Wiz's testing.
The multi-tenant trust model problem
CosmosEscape is a clean example of a recurring pattern in multi-tenant cloud architecture. When shared infrastructure holds secrets with scope beyond the tenant that initiated the request, a compromise of that shared infrastructure collapses the isolation between tenants.
The specific bug matters less than the structural condition that made it dangerous: the gateway was shared, and the secrets it held were platform-wide.
Cloud providers routinely run shared gateways, shared key management systems, and shared control planes. When those shared components hold secrets whose blast radius is the entire platform, the security model of tenants are isolated from each other depends entirely on the security of those shared components.
Wiz has found similar patterns before, including ChaosDB in Cosmos DB in 2021, and other multi-tenant exposure chains. The pattern is not specific to any one provider. It is a structural property of multi-tenant cloud architecture that requires explicit engineering effort to contain.
For Azure Cosmos DB users
No action is required. Microsoft patched the vulnerability server-side and found no evidence of customer data exposure.
The disclosure is useful for security teams assessing cloud risk posture, not as a call to action on this specific vulnerability, but as a concrete illustration of how multi-tenant trust model failures look in practice.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are evaluating cloud service security posture or multi-tenant architecture risk.