VulnerabilityPublished 31 Jul 2026

Critical Flaw Allowed to Azure Cosmos DB Pwnage

Source SecurityWeek

Severity

Critical

Rated by Threat Radar

Data as of 3 Aug 2026, 02:02 UTC

What to do

AI-suggested

Microsoft released a hotfix blocking the attack vector within two days of the vulnerability report and completed a long-term architectural fix across all regions by July 2026. The vendor has confirmed no unauthorized activity was detected and stated that no customer action is required. Organizations should ensure their Azure Cosmos DB services are updated with the latest patches and monitor official Microsoft advisories for any further guidance.

Description

Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access. The post Critical Flaw Allowed to Azure Cosmos DB Pwnage appeared first on SecurityWeek .

Impact

Exploitation of CosmosEscape would have allowed an attacker to fully compromise any Azure Cosmos DB account by obtaining its primary key, granting unrestricted read and write access to all data. This includes private, network-isolated accounts and Microsoft’s own databases used by services such as Entra ID, Teams, and Copilot. The vulnerability could have enabled attackers to precisely target organizations at platform scale by enumerating and filtering databases by subscription and tenant IDs. However, no evidence of exploitation in the wild was found.

Summary

The CosmosEscape vulnerability in Azure Cosmos DB allowed attackers to bypass the Gremlin API sandbox using .NET reflection, achieving code execution on the multi-tenant DB Gateway service. This gateway used a platform-wide signing key, termed the Cosmos Master Key, which could retrieve the primary key for any Cosmos DB account across tenants, regions, and APIs. With this key, attackers could enumerate all Cosmos DB accounts, filter by organization identifiers, and gain full read/write access to targeted databases. The vulnerability affected Microsoft’s internal use of Cosmos DB as well. Microsoft was notified in November 2025, issued a hotfix within two days, and completed a comprehensive architectural fix by July 2026. Extensive log reviews found no unauthorized access beyond testing.

References

securityweek.com/critical-flaw-led-to-azure-cosmos-db-pwnage/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 31 Jul 2026, 13:37 UTC

References

Community reviews