Threat reportVulnerabilityTL-2026-1779
CosmosEscape: Azure Cosmos DB Gremlin Sandbox Escape Exposed Platform-Wide Master Key (CVE-2026-66803)
CosmosEscape (TL-2026-1779), also tracked as CosmosEscape, is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-30. It has no confirmed attribution, affects Microsoft Azure Cosmos DB, references 1 CVE (CVE-2026-66803), maps to 16 MITRE ATT&CK techniques (T1059, T1068, T1078.004), and is covered by 9 detection rules and 28 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-1779
- Threat ID
- TL-2026-1779
- Also known as
- CosmosEscape
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- cross-sector all azure cosmos db tenants regardless of industry
- Target regions
- Global (all Azure regions)
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in CosmosEscape
Malware and tooling: Gremlin / Apache TinkerPop query language
How CosmosEscape works
Wiz Research disclosed CosmosEscape, an exploit chain against Azure Cosmos DB's Gremlin query engine that escaped the query sandbox via .NET reflection abuse to gain arbitrary code execution on the multi-tenant DB Gateway. This exposed an unscoped platform-wide signing secret (the 'Cosmos Master Key') able to retrieve the primary key of any Cosmos DB account across all tenants, regions, and the SQL, MongoDB, Cassandra, and Gremlin APIs, plus a regional Config Store enabling attackers to enumerate and target specific organizations. Tracked as CVE-2026-66803 (CVSS 3.1: 10.0); Microsoft found no evidence of customer impact and completed a platform-wide fix eliminating the Master Key in July 2026.
Wiz Research disclosed CosmosEscape, a multi-stage exploit chain against Microsoft Azure Cosmos DB that allowed any standard Cosmos DB account holder — with no access to a victim tenant required — to break out of the service's Gremlin query sandbox and ultimately retrieve a single platform-wide signing secret capable of unlocking every customer database on the service.
Cosmos DB's proprietary Gremlin engine translates Gremlin graph queries into .NET code and enforces restrictions intended to keep queries confined to graph operations. Those restrictions did not sufficiently account for .NET reflection: Wiz researchers used reflection primitives to invoke .NET Native APIs directly, building file read, file write, and ultimately arbitrary code execution capabilities from within the query sandbox — a reflective code-loading pattern that let execution occur without following the engine's intended query-to-graph-operation path. A proof-of-concept crafted query executed the `hostname` command against the DB Gateway — the multi-tenant, Service Fabric-hosted component that processes Gremlin queries for all tenants — demonstrating full remote code execution. The only prerequisite was an attacker-owned Cosmos DB Gremlin account (host, database, graph path, and primary key); no prior access to a target organization's tenant was needed. Wiz is withholding the exact malicious Gremlin query pending its Black Hat USA talk.
Code execution on the DB Gateway exposed a signing key Wiz dubbed the 'Cosmos Master Key.' Unlike normal Cosmos DB primary/secondary keys, which are scoped to a single account, this key was unscoped: it could retrieve the primary key of ANY Cosmos DB account on the service through publicly accessible endpoints, regardless of tenant, region, or API flavor (SQL, MongoDB, Cassandra, Gremlin) — because the DB Gateway itself had to reach customer databases using the target account's own primary key to service queries, and the Master Key was the mechanism that let it fetch that key for any account on demand. Because the compromised DB Gateway itself was the component enforcing network isolation policy, even private, network-isolated Cosmos DB accounts were exposed. The Master Key also unlocked the Config Store — a regional Cosmos DB database, itself queryable via the SQL engine, that functions as the master directory of every account on the service, containing account names, subscription IDs, tenant IDs, network settings, and tags — letting an attacker enumerate and filter targets by organization before retrieving that organization's key and gaining full read-write access to its databases (a cloud-infrastructure-discovery step feeding directly into a cloud-storage data-collection step).
Because internal Microsoft services including Entra ID, Teams, and Copilot store data in Cosmos DB, their databases were potentially reachable through the same chain, raising the possibility of exposure of Teams message data and Copilot conversation histories. Microsoft states its investigation of access logs found no evidence any of this occurred outside Wiz's authorized, controlled testing, and that no customer action is required.
Wiz reported CosmosEscape to Microsoft via coordinated disclosure on 2025-11-20. Microsoft blocked the vulnerable Gremlin entry point within 48 hours and completed a platform-wide architectural remediation across all regions in July 2026, eliminating the Cosmos Master Key entirely and introducing stronger service-to-service authentication, new network protections, and additional monitoring. Microsoft published the initial MSRC Security Update Guide entry for CVE-2026-66803 at 7:00 a.m. Pacific on 2026-07-30 with no CVSS base score and only sparse technical detail, ahead of NVD enrichment the same day, which recorded a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CWE-284 (Improper Access Control). Wiz published its technical write-up the same day, bylined by Wiz Research's Yuval Avrahami and Lior Maman, and plans to present the complete exploit chain at Black Hat USA on 2026-08-06.
CosmosEscape is the third major Wiz/third-party-disclosed Cosmos DB security incident. ChaosDB (reported 2021-08-12, publicly disclosed 2021-08-26), discovered by Wiz Research's Nir Ohfeld and Sagi Tzadik, abused the Cosmos DB Jupyter Notebook feature to grant any Azure user unauthorized full admin access to other customers' Cosmos DB accounts. CosMiss (reported 2022-10-03, fixed within two days, publicly disclosed 2022-11-01), discovered by Orca Security — not Wiz — exploited missing authentication on the same Jupyter Notebook feature to allow unauthenticated read/write access and remote shell execution given only a notebook's forwarding ID. CosmosEscape is technically distinct from both: it targets the Gremlin query engine and DB Gateway rather than the Jupyter Notebook surface, but continues a pattern of platform-level, service-side control-plane failures in Cosmos DB's multi-tenant architecture.
MITRE ATT&CK techniques used in TL-2026-1779
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
stealth
Discovery
T1087.004 Cloud Account; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Initial Access
T1190 Exploit Public-Facing Application
Defense Evasion
T1211 Exploitation for Stealth; T1620 Reflective Code Loading
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Lateral Movement
T1550.001 Application Access Token
Credential Access
Impact
Affected products and versions in CosmosEscape
- Microsoft — Azure Cosmos DB
Vulnerable versions: All Azure Cosmos DB accounts/regions reachable via the Gremlin API prior to the July 2026 platform-wide fix; SQL, MongoDB, Cassandra, and Gremlin API surfaces were all exposed via the shared Master Key, across production, test, development, and internet-facing Free Tier accounts
Fixed in: Platform-wide fix completed across all Azure regions in July 2026; the Cosmos Master Key was eliminated and service-to-service authentication was hardened
Remediation for CosmosEscape
Patches
- Microsoft-side platform hotfix blocking the vulnerable Gremlin entry point, deployed within 48 hours of the 2025-11-20 report
- Microsoft-side platform-wide architectural remediation completed across all regions in July 2026, eliminating the Cosmos Master Key and hardening service-to-service authentication (no customer-deployed patch exists or is required)
Immediate actions
- No customer action is required — Microsoft has already deployed and completed the platform-wide fix and eliminated the Cosmos Master Key (per Microsoft's public statement)
- As a precaution, review Azure Cosmos DB Activity Log / diagnostic logs for anomalous Gremlin API queries or unexpected primary-key regeneration events between 2025-11-20 and 2026-07-30
- Inventory all Cosmos DB accounts across subscriptions (Azure Resource Graph, `az cosmosdb list`, or PowerShell) to confirm exposure scope
- Review firewall rules and remove overly broad (e.g. 0.0.0.0) allowlists on Cosmos DB accounts
Workarounds
- None required or available — this was a service-side (Microsoft-managed control-plane) vulnerability with no customer-facing mitigation; Microsoft's fix is transparent to customers
Longer-term hardening
- Where supported, adopt Microsoft Entra ID / RBAC-based data-plane authentication and managed identities for Cosmos DB instead of primary-key (shared-secret) access, since key-based auth is inherently exposed to platform-level key-management failures of this kind
- Disable public network access and enforce private endpoints for Cosmos DB accounts where feasible
- Store any retained primary/secondary keys in Azure Key Vault and rotate them periodically
- Enable Cosmos DB diagnostic logging and Azure Monitor alerting on data-plane key usage anomalies, unusual RU consumption, unrecognized client IPs/locations, and Config Store-style enumeration patterns
- Track Wiz's Black Hat USA 2026 (2026-08-06) full technical disclosure for any additional detection guidance released alongside the withheld exploit query
CVEs associated with CosmosEscape
Weaknesses (CWE) in CosmosEscape
Timeline of CosmosEscape
- Wiz Research (Nir Ohfeld and Sagi Tzadik) reports ChaosDB, an earlier critical Azure Cosmos DB vulnerability chain abusing the Jupyter Notebook feature, granting unauthorized full admin (read/write/delete) access to other customers' Cosmos DB accounts; publicly disclosed 2021-08-26. Cited as historical precedent for platform-level Cosmos DB control-plane failures.
- Orca Security (not Wiz) reports CosMiss to Microsoft, a separate unauthenticated RCE vulnerability in the same Jupyter Notebook feature allowing full notebook access and remote shell execution given only a notebook's forwarding ID; fixed within 2 days and publicly disclosed 2022-11-01.
- Wiz Research identifies the CosmosEscape Gremlin sandbox-escape chain and reports it to Microsoft via coordinated vulnerability disclosure (MSRC).
- Microsoft blocks the vulnerable Gremlin entry point within 48 hours of the report, cutting off the exploit path while longer-term architectural remediation work begins.
- Microsoft states that its investigation of access logs found no evidence of customer impact or of exploitation beyond Wiz's authorized research testing, and that no customer action is required.
- Wiz Research publishes its CosmosEscape technical write-up, bylined by Yuval Avrahami and Lior Maman; The Hacker News and other outlets report on the platform-wide impact.
- NVD enrichment publishes CVE-2026-66803 with a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CWE-284 (Improper Access Control); CISA adds SSVC scoring the same day.
- Microsoft publishes the initial MSRC Security Update Guide entry for CVE-2026-66803 at 7:00 a.m. Pacific with no CVSS base score and only minimal technical detail (CVE number, brief product description, standard confidence boilerplate).
- Microsoft completes the platform-wide fix across all Azure regions, eliminating the unscoped Cosmos Master Key and hardening service-to-service authentication.
- Wiz Research is scheduled to present the complete CosmosEscape exploit chain, including the currently withheld malicious Gremlin query, at Black Hat USA 2026.
Sources cited for CosmosEscape
- CosmosEscape: Taking Over Every Azure Cosmos DB
- Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database
- MSRC Security Update Guide — CVE-2026-66803
- NVD — CVE-2026-66803 Detail
- New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances
- Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover
- CosmosEscape: Wiz Research Breached Azure Cosmos DB Gateway, Extracted Key to Every Database
- Microsoft Flags Azure Cosmos DB RCE Vulnerability; Here's What You Need to Do Now
- How we broke the cloud with two lines of code: the full story of ChaosDB
- CosMiss: Azure Cosmos DB Notebook Remote Code Execution Vulnerability
Detection coverage for TL-2026-1779
As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1779 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.