CosmosEscape: A Flawed Gremlin Sandbox Could Have Hijacked Every Azure Cosmos DB
The Wiz team discovered CosmosEscape, a flaw in Azure Cosmos DB’s Gremlin API that exposed a platform‑wide master key, letting any attacker retrieve the primary key of any Cosmos DB account. Microsoft patched the issue and eliminated the master key, reporting no evidence of customer impact.