Azure Cosmos DB Flaw Let Researchers Reach Any Customer's Database

Key points

• Cloud security firm Wiz found a flaw in Azure Cosmos DB, Microsoft's global database service, that could have exposed customer databases across the platform.
• The exploit chain, codenamed CosmosEscape, started with a booby-trapped query and ended with a platform-wide key giving read and write access to other tenants.
• Microsoft has patched the issue, and Wiz says it found no evidence any criminal group used it before disclosure.
• Cosmos DB customers do not need to rotate keys or take action, according to Microsoft's advisory.
• The finding lands in a run of cross-tenant bugs Wiz has reported in Azure since 2021.

Researchers at cloud security firm Wiz say they found a way to break out of a shared corner of Microsoft's Azure Cosmos DB service and reach databases belonging to other customers.

Azure Cosmos DB is a database service Microsoft rents to companies who want to store customer records, product catalogues, chat histories and similar data in the cloud. Wiz named the attack chain CosmosEscape and reported it privately to Microsoft, which has since patched it.

The short version: a paying customer could have used the service to spy on, or tamper with, the data of any other customer on the same platform. That is the kind of failure cloud providers are supposed to make impossible.

How did the attack work?

The researchers started with a malicious query aimed at their own database, then chained a series of weaknesses until they held a master key for the wider service. First reported by The Hacker News, the chain begins inside Gremlin, a query language Cosmos DB uses for graph data (think social networks or fraud maps, where the links between records matter as much as the records themselves).

Gremlin queries run inside a sandbox, a walled-off area that is meant to stop one customer's code touching anything else. Wiz found a way to escape that sandbox and run code on the underlying machine. From that foothold, the researchers reached an internal component that handed out a platform-wide credential, effectively a skeleton key for Cosmos DB.

With that key in hand, an attacker could read or change data in databases belonging to other Azure customers on the same infrastructure.

Who is affected?

Any organisation using Azure Cosmos DB was theoretically exposed while the bug existed, but Microsoft and Wiz say there is no sign anyone other than the researchers found it. That covers a large slice of enterprise Azure users, since Cosmos DB backs everything from retail loyalty apps to airline booking systems.

Microsoft fixed the flaw on its side. Customers do not need to rotate their own keys or reconfigure anything, according to the vendor's guidance.

Should ordinary customers worry?

Probably not, but it is worth understanding what almost happened. If a criminal group had found this first, they could have pulled personal data, payment records or medical files out of any company hosting them on Cosmos DB, without needing to hack that company directly. The victim would be the cloud, not the tenant.

For most people, the practical takeaway is dull but true: watch the usual signals. If a service you use tells you your data was accessed, act on the notice. Do not rely on the cloud provider being flawless.

Why this keeps happening

Wiz has now disclosed several cross-tenant flaws in Azure since 2021, including the earlier ChaosDB bug that also hit Cosmos DB. The pattern is consistent: shared infrastructure, complex query engines, and internal services that trust each other too much. Fix one path, another appears.

Microsoft credited Wiz for the private disclosure and said no customer action is required.