Wiz Uncovers Critical Azure Cosmos DB Flaw: One Key Could Unlock All Databases
rseroter · x · 2026-07-31
Wiz Research disclosed a critical vulnerability chain in Azure Cosmos DB dubbed CosmosEscape. Exploiting this allowed attackers to acquire the 'Cosmos Master Key', granting on-demand retrieval of any Cosmos DB account's primary key for full read/write access, alongside the ability to enumerate and target all databases on the service.
Cosmos DB is heavily used internally at Microsoft (including Entra ID, Teams, and Copilot), exposing internal databases to potential risk. Microsoft has fully remediated the issue and introduced new guardrails. Notably, the research was assisted by an early version of Atlas, Wiz's AI vulnerability researcher.
More from Safety
- Anthropic grants METR inside access to audit its AI models and safety practices — The Decoder · 2026-10-16
- Agent actions need checks outside the model: NVIDIA demos lean on guardrails amid wave of real agent incidents — Creamy-And-Crowded · 2026-10-16
- Vitalik builds "paranoid mode" agent wrapper with Tor, zkAPI and local prompt rewriting — DavideCrapis · 2026-10-16
- Security team demos Signal 1-click exploit technique at Hexacon Paris — moyix · 2026-10-16
- China moves to impose registration and licensing on frontier AI model weights and chip designs — deanwball · 2026-10-16
- Same agent task, two auth models: shared admin login wipes 1M audit rows, per-agent identity gets refused — Prompt Engineering · 2026-10-16