Loading story…
Microsoft patched a critical Azure Cosmos DB vulnerability that researchers said could have enabled cross-tenant database takeover by exposing a platform-wide signing secret. Wiz, which dubbed the exploit chain CosmosEscape, reported that an attacker with only a standard Azure account and an attacker-controlled Cosmos DB Gremlin database could escape the Gremlin query sandbox, achieve code execution on a multi-tenant gateway, and obtain a key capable of accessing other customers’ databases.
According to the disclosure, the exposed secret could be used to retrieve primary account keys across tenants, regions, and multiple Cosmos DB API variants, including SQL, MongoDB, Cassandra, and Gremlin, potentially affecting even private or network-isolated accounts. Microsoft said it blocked the vulnerable Gremlin input within 48 hours of disclosure in November 2025, completed a permanent global fix in July 2026, and removed the platform-wide key; the company added that it found no evidence of customer impact or unauthorized activity beyond the researchers’ testing and said no customer action was required.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
In July 2026, Microsoft finished a permanent fix for the Azure Cosmos DB vulnerability across all regions. As part of the remediation, it removed the platform-wide key that enabled cross-tenant access.
Within 48 hours of Wiz's November 2025 report, Microsoft blocked the vulnerable Gremlin input used in the exploit chain. This was an initial mitigation to stop exploitation while broader remediation continued.
In November 2025, Wiz disclosed the CosmosEscape exploit chain to Microsoft. The chain allowed sandbox escape in the Gremlin query engine, code execution on a multi-tenant gateway, and exposure of a platform-wide signing secret that could be used to access other tenants' databases.
Public reporting described the flaw as a critical Azure Cosmos DB vulnerability that threatened cross-tenant database takeover. Coverage tied the issue to the now-patched weakness in Cosmos DB's Gremlin functionality.
Wiz said it would present the full CosmosEscape exploit chain at Black Hat USA on August 6. Public disclosure at that point showed only the result of a crafted query executing the hostname command on a Cosmos DB backend system.
After investigating the issue, Microsoft said it found no evidence that customers were affected and no unauthorized activity beyond the researchers' testing. The company also said no customer action was required.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcemkd-cirt.mk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has patched a critical Azure Cosmos DB vulnerability chain dubbed **CosmosEscape** that could have let an attacker move from a crafted **Gremlin API** query to code execution on a multi-tenant backend component and ultimately obtain secrets capable of accessing virtually any customer Cosmos DB account. Wiz reported that insufficient restrictions around .NET reflection allowed escape from the Gremlin sandbox, exposing a platform-wide signing secret—described as the **Cosmos Master Key**—and a regional account directory that could be used to locate target accounts and retrieve their primary keys. With those primary keys, an attacker could have gained full read and write control over Cosmos DB deployments across **SQL, MongoDB, Cassandra, and Gremlin** APIs, including private databases across regions and potentially data tied to Microsoft services such as **Entra ID, Teams, and Copilot**. Microsoft said it blocked the vulnerable Gremlin entry point within 48 hours of Wiz’s November 2025 report, later completed broader fixes across all regions, removed the shared platform-wide key, and added controls to prevent similar backend access; the company said its review found no evidence of exploitation or customer data access beyond the researchers’ testing, and no customer action is required.
Jul 31, 2026
Wiz disclosed **ChaosDB**, a critical cross-tenant vulnerability chain in Azure Cosmos DB's Jupyter Notebook feature. Misconfigurations let notebook C# code execute as root, bypass container-local firewall controls, and reach Azure instance metadata and WireServer services on shared hosts. Researchers obtained certificates and private keys, authenticated to Azure Service Fabric, and decrypted Cosmos DB primary keys, notebook tokens, and storage-account credentials belonging to other customers. The exposed Cosmos DB keys enabled persistent full read, write, and delete access to affected accounts, and Wiz reported access to databases associated with several thousand Azure customers. Microsoft disabled the vulnerable notebook service within 48 hours of the August 2021 report and later confirmed that several thousand customers were affected; it revoked some credentials and notified more than 30% of Cosmos DB customers to rotate keys. Organizations with Jupyter Notebooks enabled—especially accounts permitting external or cross-tenant network access—were advised to regenerate primary keys, restrict network exposure, move from shared keys to RBAC, and use private endpoints. Wiz later used ChaosDB to introduce **PEACH**, a tenant-isolation assessment framework covering Privilege, Encryption, Authentication, Connectivity, and Hygiene to identify and harden cross-tenant boundaries in cloud applications.
Sep 3, 2026
Researchers disclosed two severe flaws in **Azure API Connections** that exposed the trust model behind Microsoft’s managed connectors and could let attackers abuse authenticated connections to reach protected backend services. In the first issue, users with only **Reader** access to a connection could reportedly send authenticated requests through undocumented `/extensions/proxy` endpoints and inherit the connection’s existing privileges, exposing data from services including **Azure Key Vault, Azure SQL, Jira, Slack, Salesforce, Azure Storage, Defender ATP, and Google services**. The researcher also reported that the Jira connector could be abused for **SSRF** and API token theft when `APIToken` authentication was configured. A second report alleged that Azure’s globally shared API Management architecture for connectors enabled **cross-tenant compromise** through Azure Resource Manager’s undocumented `DynamicInvoke` endpoint. By combining a custom connector with path traversal, an attacker could reportedly make privileged requests against arbitrary victims’ API Connections and potentially control or extract data from connected backends with inherited administrator-level access. The researcher said Microsoft confirmed the issue within days, deployed mitigations within a week, and later awarded a **$40,000** bounty, although the published write-up warned the fix relied largely on blocking `../` and encoded variants and might be bypassable.
Aug 20, 2026