The skeleton key problem: when one secret unlocks every cloud tenant

Cloud platforms keep rediscovering the same design error. Concentrate authority in a single secret that the platform itself must hold on every tenant's behalf, and any flaw that reaches that secret becomes everyone's problem at once. When that design appears in a flagship cloud database service, the blast radius runs from every customer to the platform's own internal tools.

Wiz Research has documented the latest instance: a chain reachable through a public Gremlin graph query that yielded what researchers called a "Cosmos Master Key," capable of listing every database on the service and retrieving any tenant's primary key on demand. The same research identified exposure across Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot.

Most readers will file this as another patched bug. The pattern underneath is sturdier. The risk was not a missing patch. It was a design in which one platform-wide credential, held by the service, could authenticate against every customer's data, so a single mistake anywhere in the system had no ceiling on what it could reach. Wiz disclosed a structurally similar flaw, ChaosDB, four years earlier, which suggests the failure is recurring, not isolated.

Microsoft has now retired the Cosmos Master Key as part of the fix. The mechanism carries to the next story: any cloud service that holds a master credential on its tenants' behalf is a candidate for the same class of break, and the only durable fix is removing the master rather than guarding it better.