--- title: CosmosEscape: Taking over Every Database in Azure Cosmos DB description: Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API that allowed full takeover of every database on the platform.... canonical: https://daily.dev/posts/cosmosescape-taking-over-every-database-in-azure-cosmos-db-7zp4vevni twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CosmosEscape: Taking over Every Database in Azure Cosmos DB | daily.dev og:description: Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API that allowed full takeover of every database on the platform.... og:url: https://daily.dev/posts/cosmosescape-taking-over-every-database-in-azure-cosmos-db-7zp4vevni og:image: https://api.daily.dev/og/posts/7Zp4vEVni.png og:image:alt: CosmosEscape: Taking over Every Database in Azure Cosmos DB og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CosmosEscape: Taking over Every Database in Azure Cosmos DB **[Hacker News](https://daily.dev/sources/hn)** · 10 min read · 0 upvotes · 0 comments ## Summary Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API that allowed full takeover of every database on the platform. By exploiting .NET reflection to bypass the Gremlin query sandbox, researchers achieved arbitrary code execution on the DB Gateway — a multi-tenant service that processes customer queries. From there, they uncovered a platform-wide signing key (dubbed the 'Cosmos Master Key') that could retrieve the primary key of any Cosmos DB account across all tenants, regions, and API types. Combined with access to the Config Store — a registry of all Cosmos DB accounts — attackers could have enumerated and compromised any customer database, including internal Microsoft databases used by Teams, Entra ID, and Copilot. Network-isolated accounts were also affected. Microsoft was notified in November 2025, deployed a hotfix within 48 hours, and completed a full architectural remediation by July 2026. No evidence of exploitation was found. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 20 comments across hackernews (as of 2026-07-30). **TL;DR:** The community is largely critical of Microsoft and Azure Cosmos DB, viewing this as yet another serious security failure in a pattern of repeated vulnerabilities, though some commenters acknowledge the complexity of the remediation work. **Sentiment:** 5% positive · 30% mixed · 65% skeptical **The case for** - The vulnerability was patched within 2 days of discovery, showing a rapid initial response. - The 6-month rearchitecting effort reflects the scale and seriousness with which Microsoft treated the fix, given Cosmos DB powers critical internal services like Teams and Copilot. **The pushback** - This is at least the second time Wiz has discovered a global Cosmos DB vulnerability, raising questions about whether the platform can be trusted for mission-critical workloads. - Using a single master key to handle all Cosmos DB requests was seen as a fundamental architectural footgun. - The Gremlin query engine's failure to account for .NET reflection was called 'unbelievably amateurish' by commenters. - Microsoft has a broader pattern of losing or misusing master keys, which commenters noted is becoming a recurring tradition. **By community** - hackernews (skeptical): Commenters are broadly critical of Microsoft's repeated Cosmos DB security failures and the architectural decisions that enabled them, though a few defend the complexity of the remediation. **Hottest debate:** Whether 6 months to remediate was reasonable given the architectural rework required, or inexcusably slow for a critical cloud service. **Open questions** - Will the rearchitected backend truly eliminate the class of vulnerability, or will another master-key-style design flaw emerge? - Why does Microsoft keep relying on single master keys for broad platform access across multiple high-profile incidents? **Highlights** > They patched the vulnerability within 2 days. They spent 6 months rearchitecting their backend. It's a major service for themselves and tens of thousands of customers, you don't vibe code yourself a new database query execution engine overnight. > — [delfinom on hackernews](https://news.ycombinator.com/item?id=49112679) > > Cosmos DB's engine translated Gremlin queries into .NET code, enforcing a set of restrictions designed to prevent queries from reaching beyond Gremlin operations. These restrictions, however, didn't sufficiently account for .NET reflection Wow, this is so unbelievably amateurish. > — [gtowey on hackernews](https://news.ycombinator.com/item?id=49111735) > Incredible that this is the second time Wiz has discovered a global Cosmos DB vulnerability (https://chaosdb.wiz.io/) and a shock that anyone is trusting Microsoft, Azure or in particular Cosmos DB with anything mission critical > — [redwood on hackernews](https://news.ycombinator.com/item?id=49109852) > Considering that they had to rework things to not use the master key, I can understand the time and effort. From TFA, the DB Gateway handled all Cosmos requests, and used the master key to get an account’s private key and then forward the DB requests. If they had to rearchitect that gateway system, I’m sure it was no small task. Bear in mind, they probably approached this somewhat seriously since Cosmos powers lots of internal M$ tools like Teams and Copilot, not just customer applications. > — [phatskat on hackernews](https://news.ycombinator.com/item?id=49113517) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49108963) · 26 points · 20 comments ## Similar posts on daily.dev - [No single pane of glass: Anatomy of an Azure permission takeover](https://daily.dev/posts/no-single-pane-of-glass-anatomy-of-an-azure-permission-takeover-q7x1g2hf6) · Sysdig Blog · 0 upvotes · 0 comments - [16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows](https://daily.dev/posts/16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows-br9vggrsx) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#azure-cosmos-db](https://daily.dev/tags/azure-cosmos-db) [View this post on daily.dev](https://daily.dev/posts/cosmosescape-taking-over-every-database-in-azure-cosmos-db-7zp4vevni) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CosmosEscape: Taking over Every Database in Azure Cosmos DB","url":"https://daily.dev/posts/cosmosescape-taking-over-every-database-in-azure-cosmos-db-7zp4vevni","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cosmosescape-taking-over-every-database-in-azure-cosmos-db-7zp4vevni"},"datePublished":"2026-07-30T15:24:03.353Z","dateModified":"2026-07-30T18:57:09.128Z","description":"Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API that allowed full takeover of every database on the platform....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99174e493621a2643f09528ffe6a0075?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99174e493621a2643f09528ffe6a0075?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cosmosescape-taking-over-every-database-in-azure-cosmos-db-7zp4vevni","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,azure-cosmos-db","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"CosmosEscape: Taking over Every Database in Azure Cosmos DB"}]} ```