Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database

Summary: Wiz researchers found a now-patched Azure Cosmos DB flaw, codenamed CosmosEscape, that let a crafted Gremlin query escape the service's query sandbox, reach a multi-tenant gateway, and expose a platform-wide signing secret plus a regional account directory. Microsoft blocked the vulnerable Gremlin entry point within 48 hours of the November 2025 report and completed the longer-term fix across all regions in July 2026, eliminating the platform-wide key, while saying it found no evidence of customer impact.
What you should know: The only prerequisite was a standard Azure account and a Gremlin database the attacker controlled, creatable in minutes with no special permissions or prior foothold - and Wiz says the key unlocked every account it tested across tenants, regions, and the SQL, MongoDB, Cassandra, and Gremlin APIs, including private and network-isolated accounts.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026