Microsoft almost gave away the keys to everyone’s Azure Cosmos DBs
Summary
Microsoft had a critical vulnerability in Azure Cosmos DB (a NoSQL database that stores data in the cloud), specifically in its Gremlin API (a tool for managing graph-structured data). Attackers who discovered it could have stolen the Cosmos Master Key, giving them read and write access to any database and a list of all databases on the service. Microsoft patched the issue after being notified by security researchers.
Solution / Mitigation
Microsoft deployed a hot fix within two days of learning about the vulnerability. The company then spent eight months re-engineering the infrastructure to remove the Cosmos Master Key and introduce new guardrails to Cosmos DB to prevent similar attacks.
Classification
Affected Vendors
Related Issues
Original source: https://www.csoonline.com/article/4203921/microsoft-almost-gave-away-the-keys-to-everyones-azure-cosmos-dbs.html
First tracked: July 31, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 75%