Wiz says Azure Cosmos DB flaw could have exposed every database

Why it matters

CosmosEscape shows how one provider-side sandbox failure can bypass customer network controls when an internal service holds credentials with cross-tenant authority.

Wiz Research published a technical report about CosmosEscape, a vulnerability chain in Azure Cosmos DB's Gremlin API that it says could have allowed full read and write access to every database on the service. Microsoft said in a statement included in Wiz's report that it found no evidence of exploitation beyond Wiz's research and that no customer action is required.

The finding carries unusual founder history. Assaf Rappaport, Ami Luttwak, Yinon Costica and Roy Reznik founded Wiz in 2020 after building Adallom, selling it to Microsoft in 2015 and leading Microsoft's cloud security organization. Wiz is now publishing research into a flaw deep inside the infrastructure operated by its founders' former employer.

The Wiz authors named the chain CosmosEscape. According to Wiz's technical report, the researchers used specially crafted Gremlin queries against a database they controlled to gain code execution on the Cosmos DB backend and eventually reach a platform-wide signing secret that Wiz called the "Cosmos Master Key."

One query crossed the tenant boundary

The first clue was a .NET exception generated while Wiz researchers queried a database they controlled. Most open-source Gremlin systems are based on the Java Virtual Machine, so the exception indicated that Microsoft had built a custom engine that translated Gremlin queries into .NET code.

Wiz says the engine restricted what generated code could do, but its sandbox did not account sufficiently for .NET reflection. The researchers developed file read and write capabilities, followed by arbitrary code execution on the Cosmos DB backend. A screenshot in the report shows a crafted query executing the hostname command.

That code ran on a component called the DB Gateway, which processes customer queries on multi-tenant Service Fabric clusters. Customer databases were hosted elsewhere, but the gateway needed their primary keys to access them. Those keys grant full read and write access.

The gateway obtained account keys through a signing credential available from its cluster. Wiz found that the credential worked across customers, regions and Cosmos DB interfaces, including SQL, MongoDB, Cassandra and Gremlin. Publicly accessible endpoints could use it to request the primary key for a chosen account, according to the report.

The same credential opened a second path through a regional database Wiz calls the Config Store. That directory contained Cosmos DB account names, tenant and subscription identifiers, network settings and tags. An attacker could have searched it for a specific organization and then requested the primary key for that organization's account.

Wiz says the chain also reached private and network-isolated databases. The compromised DB Gateway was responsible for enforcing those network restrictions, placing the attack inside the boundary customers relied on for isolation. Because the failure sat in Cosmos DB's service layer, customers could not patch it through their own configurations.

The potential reach extended into Microsoft's own products. Wiz identified Microsoft Teams, Microsoft Entra ID and Microsoft Copilot as services that store data in Cosmos DB. The report says databases supporting those services were potentially reachable through the same chain. Microsoft found no evidence that anyone exploited the vulnerability outside Wiz's testing, according to the statement included in Wiz's report.

Microsoft says it fully remediated the issue

Wiz says Microsoft fully remediated the issue, eliminated the Cosmos Master Key and added guardrails intended to prevent similar attacks. In the vendor statement included in Wiz's report, Microsoft said it reviewed access logs and found no unauthorized activity beyond the researchers' tests. Microsoft also said no customer action is required.

The remediation described by Wiz goes beyond the Gremlin sandbox. Removing the cross-tenant signing credential addressed the design decision that turned one sandbox escape into a service-wide compromise.

Wiz says it will present the full query at an upcoming Black Hat USA talk. The company has withheld the full query from the public report until that presentation.

Atlas gets a real-world test

The disclosure also gives Wiz's AI security work a concrete role in a live investigation. Wiz says an early version of Atlas, its AI vulnerability researcher, assisted with CosmosEscape.

Wiz has presented Atlas as a system that can help reproduce and investigate vulnerabilities, while acknowledging that discovering an unknown flaw from scratch is harder.

CosmosEscape moves Atlas closer to that harder category. The technical narrative remains driven by the researchers' observations: spotting an unexpected exception, inferring the existence of a custom execution engine and following the gateway's credentials into Cosmos DB's internal account directory.

Atlas's specific contribution will determine how much CosmosEscape says about AI-assisted security research. An agent that accelerates testing and exploit validation is already useful. A system that independently identifies the key architectural leap from a sandbox escape to a platform-wide credential would represent a larger advance.

Research becomes part of Wiz's multicloud case

The disclosure arrives four months after Google completed its acquisition of Wiz on March 11. Google has said Wiz will retain its brand and continue supporting Microsoft Azure, Amazon Web Services, Oracle Cloud and other environments.

Publishing a severe Azure finding serves that multicloud position. Wiz now operates inside a cloud provider while selling security coverage across competing clouds. Research that subjects Microsoft infrastructure to close inspection helps demonstrate that the Azure part of that commitment remains active under Google ownership.

It also serves Wiz commercially. A vulnerability that bypassed customer network isolation and reached a provider's internal authentication layer reinforces the premise Rappaport and his co-founders used to start Wiz: cloud risk often emerges from relationships among identities, services and control-plane components rather than from a single misconfigured server.

CosmosEscape is also a warning for cloud platform builders. A sandbox escape should have remained confined to the query-processing environment. The presence of a platform-wide credential on the other side of that boundary converted code execution in one customer's workflow into a potential route to every tenant. Microsoft eliminated that credential as part of the long-term fix. The architecture had given one internal component far more authority than it could safely hold.