Critical Flaw Led to Azure Cosmos DB Pwnage

Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access. The post Critical Flaw Led to Azure Cosmos DB Pwnage appeared first on SecurityWeek .

The article reports on CosmosEscape, a critical vulnerability in Azure Cosmos DB that exposed a platform-wide signing secret and allowed retrieval of any account’s primary key, granting full read and write access across tenants and regions.[1][2][5][6] According to Microsoft and Wiz, this could have enabled cross-tenant compromise of customer and internal Microsoft databases that depend on Cosmos DB, but was patched with no evidence of malicious exploitation.[2][5][6] From a RealGround perspective, CosmosEscape represents an extreme multi-tenant data leakage and cloud control-plane risk, directly affecting AI-backed services (e.g., Copilot, Entra ID, Teams) that store data in Cosmos DB and rely on its isolation guarantees.[3][5][6] Organizations building or consuming AI systems on cloud databases should treat shared control-plane keys and cross-tenant access paths as critical supply-chain risks, requiring architecture reviews, continuous red teaming of data isolation boundaries, and formal policies around key scoping, rotation, and third-party AI service dependencies.