Azure Cosmos DB flaw exposed a master key that unlocked every customer database

Wiz Research disclosed CosmosEscape, a critical flaw chain in Microsoft's Azure Cosmos DB that could have given an attacker read and write access to every customer database on the service, including Microsoft's own. Starting from a crafted query against an attacker-controlled Gremlin database, the researchers escaped the query sandbox using .NET reflection, ran code on a shared gateway, and retrieved a platform-wide signing secret they call the Cosmos Master Key. That key let them fetch the access key for any Cosmos DB account on demand, reaching even private, network-isolated databases. Microsoft assigned CVE-2026-66803, fixed the issue across all regions, and found no evidence of abuse. Nothing needs patching by customers.

Check

No customer patching is required since Microsoft fixed this in the service, but review Cosmos DB access logs for unusual activity and consider rotating account keys as a precaution.

Affected

Azure Cosmos DB customers using the Gremlin API were at risk while the flaw was live; the exposed master key could reach any account's data across tenants, though Microsoft reports no abuse.

Fix

Treat this as a reminder that multi-tenant cloud isolation can fail: rotate Cosmos DB keys periodically, prefer short-lived credentials and network limits, and monitor database access.