Critical Cosmos DB flaw exposed master key risk
🛡️ A security researcher discovered a critical vulnerability in Azure Cosmos DB's Gremlin API that could have exposed the Cosmos Master Key, granting attackers read/write access to any Cosmos account and revealing database identifiers. Wiz, a Google subsidiary, disclosed the issue to Microsoft in November 2025; Microsoft pushed a hot fix within two days and later re-engineered the service to remove the master key and add guardrails. This follows a prior 2021 finding where Cosmos DB keys were exposed via a Jupyter Notebook flaw.
