Microsoft patches critical Azure Cosmos DB vulnerability

A critical vulnerability in Microsoft's Azure Cosmos DB service, which could have granted an attacker full control over any customer database and exposed internal Microsoft systems, has been patched after being discovered by security researchers. The flaw, dubbed "CosmosEscape," was publicly disclosed on July 30, 2026, following a coordinated disclosure process that began in November 2025.

The vulnerability resided in the service's Gremlin API, an interface for querying graph databases. According to researchers from Wiz, a malicious actor with their own Azure Cosmos DB account could craft a specialized Gremlin query to break out of the intended secure processing environment. This allowed for arbitrary code execution on a multitenant backend component known as the DB Gateway.

From this position, the researchers obtained a platform-wide secret they named the "Cosmos Master Key." Possession of this key granted two powerful capabilities. First, it could be used to retrieve the primary key for any Cosmos DB account across all tenants, regions, and supported APIs, including SQL, MongoDB, Cassandra, and Gremlin. A primary key grants full read and write access to all databases within an...