Azure Cosmos DB Flaw Exposed Cross-Tenant Database Access Risk

Microsoft patched a critical Azure Cosmos DB vulnerability that researchers said could have enabled cross-tenant database takeover by exposing a platform-wide signing secret. Wiz, which dubbed the exploit chain CosmosEscape, reported that an attacker with only a standard Azure account and an attacker-controlled Cosmos DB Gremlin database could escape the Gremlin query sandbox, achieve code execution on a multi-tenant gateway, and obtain a key capable of accessing other customers’ databases.

According to the disclosure, the exposed secret could be used to retrieve primary account keys across tenants, regions, and multiple Cosmos DB API variants, including SQL, MongoDB, Cassandra, and Gremlin, potentially affecting even private or network-isolated accounts. Microsoft said it blocked the vulnerable Gremlin input within 48 hours of disclosure in November 2025, completed a permanent global fix in July 2026, and removed the platform-wide key; the company added that it found no evidence of customer impact or unauthorized activity beyond the researchers’ testing and said no customer action was required.