Police said they found a passport issued to a 55-year-old Syrian man at the scene, and that the suspect had claimed to be a member of the Islamic State militant group.
“The investigation is considering all possibilities and we are not ruling out terrorism,” Cologne deputy police chief Miriam Brauns told a news conference.
Heavily armed police commandos using stun grenades had shot the man when
they stormed the scene, freeing the female hostage who suffered minor injuries. Two other people were injured and the attacker was badly wounded with multiple shots.
Authorities had received an alert at 12:42 local time at Cologne railway station, one of the busiest in Europe. They evacuated the scene and halted all trains at the station next to Cologne's iconic twin-spired cathedral.
The man sparked panic when he entered a McDonald's restaurant inside the station and hurled a molotov cocktail, leaving a 14-year-old girl with burns.
An eyewitness told journalists how she heard screams and saw “a girl running for her life” with flames spreading up her leg, before she was helped by bystanders.
Syrian passport found
As the sprinkler system activated and water rained down in the fast-food restaurant, the man entered an adjacent pharmacy and took another woman hostage, whom he also threatened to burn in the ensuing drama, said police.
Police negotiated with him in a bid to defuse the tense situation and ascertain his motive, then stormed the pharmacy around 3:00 pm.
The man was holding a pistol — said to be either a replica or real, when commandos stormed the site, and he was also in possession of a flammable liquid and camping gas containers, two of them taped together.
“Special response units overpowered the man. During the police action he hurt two bystanders, one of them seriously,” police said in a statement.
Police said they could not yet positively identify the hostage taker, who was undergoing surgery, but believed he was a 55-year-old Syrian migrant.
Syrian identity documents had been found in the pharmacy for a man who had been issued a residency permit in Germany valid until 2021.
The man identified in the document was known to police for previous offences including theft and illegal drugs possession.
Klaus-Stephan Becker, head of Cologne criminal police, also told news channel NTV that “it could be a foiled terrorist attack”.
The man had carried a suitcase and bag, which he left in the restaurant, and had also demanded “the release of a Tunisian woman”, said police commander Klaus Rueschenschmidt, without giving further details.
Police set up a webpage where members of the public could upload pictures and video related to the incident, while their own investigations were “at full pitch”.
Germany remains on high alert over the risk of a jihadist attack, having suffered several in recent years.
The bloodiest claimed by the Islamic State jihadist group was a truck rampage through a Berlin Christmas market in December 2016 that left 12 people dead.
In June 2018, German police said they foiled what would have been the first biological attack with the arrest of a Tunisian suspected jihadist in possession of the deadly poison ricin and bomb-making material.
Germany remains a target for jihadist groups, in particular because of its involvement in the coalition fighting IS in Iraq and Syria, and its deployment in Afghanistan since 2001.