CosmosEscape lets attackers hijack every Azure Cosmos DB database
Wiz researchers discovered CosmosEscape, a vulnerability in Azure Cosmos DB’s Gremlin API that exposes a platform‑wide master key. An attacker could enumerate all databases and steal any primary key, effectively taking over every Cosmos DB instance, including Microsoft’s own services. Microsoft has now patched the flaw.