CosmosEscape: your cloud provider is shared fate

Wiz disclosed CosmosEscape yesterday: a chain in Azure Cosmos DB that gave researchers a single platform-wide credential capable of pulling the primary key of any Cosmos DB account on the service. Microsoft has fixed it, found no evidence of abuse, and says no customer action is required. All true, and all beside the point. The lesson in CosmosEscape isn't a patch — it's that your cloud provider's control plane is a dependency you cannot audit, test, or firewall.

What actually happened

Per the Wiz research writeup, the entry point was the Gremlin graph API. Unsafe .NET reflection during Gremlin query compilation let a crafted query run code on the multi-tenant DB Gateway. On that gateway sat a signing credential Wiz named the Cosmos Master Key — a secret that could mint primary keys for accounts across tenants, across regions, and across API flavors: SQL, MongoDB, Cassandra, Gremlin. The same foothold exposed a Config Store, a regional registry of every Cosmos DB account with subscription IDs, tenant IDs, and network settings — effectively a searchable directory of targets.

Two details are worth sitting with. First, private and network-isolated accounts were reachable too; the compromise happened above the layer where your network rules apply. Second, Cosmos DB is where Microsoft stores data for its own services, including Entra ID, Teams, and Copilot.

The timeline: Wiz reported it on November 20, 2025. Microsoft shipped an emergency hotfix on November 22, blocking the vulnerable path in 48 hours, then spent until July 2026 on the architectural fix that eliminated the platform-wide key. SecurityWeek notes Microsoft's review found no unauthorized activity outside the researchers' own testing.

Why cloud vendor risk matters for your business

Read that timeline again from where you sit. For eight months, a cross-tenant key existed in a service you may run production data on, and there was no advisory, no CVE to track, no dashboard that would have told you. Every security control you own — private endpoints, IP restrictions, key rotation policy — was irrelevant to this bug. That's the deal with managed services, and it's usually a good deal. It just isn't a free one.

So stop budgeting for provider breaches as if they're a patching problem. Know what lives where. Most small companies cannot produce, in under an hour, a list of which vendor holds which category of customer data. That list is the entire prerequisite for responding to any of this. Prefer identity over shared secrets — Entra ID / RBAC access to a data store is revocable per principal and shows up in logs; a primary account key is a bearer token that works from anywhere until someone rotates it. Turn on data-plane logging and keep it somewhere the provider doesn't control, because if your provider is the incident, their telemetry is the thing under investigation.

And when you evaluate a vendor, weigh disclosure behavior alongside features. Microsoft's handling here was, honestly, good: 48-hour mitigation, full architectural remediation, public writeup. Plenty of vendors would have shipped the hotfix and said nothing at all.

Sources: Wiz Research, SecurityWeek.