Wiz Research discovered Cosmos Escape, a critical vulnerability in Azure Cosmos DB's Gremlin API that could have compromised every database in the service, including Microsoft's internal databases. The exploit could grant attackers a "Cosmos Master Key," enabling them to retrieve the primary key of any Cosmos DB account for full read/write access and enumerate all databases, filtering by organization identifiers like subscription and tenant IDs.

This vulnerability posed a significant risk, as services like Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot store data in Cosmos DB. By chaining the "Takeover" and "Enumeration" capabilities, attackers could precisely target and compromise specific organizations' databases from publicly accessible endpoints.

Microsoft has since remediated the issue, eliminating the Cosmos Master Key and implementing new guardrails in Cosmos DB. No customer action is required, and Microsoft found no evidence of exploitation beyond the research. The vulnerability was discovered by observing a suspicious .NET exception during Gremlin query execution, which suggested a weakness in Cosmos DB's custom Gremlin engine sandbox.