# CosmosEscape: Azure Cosmos DB Gremlin Sandbox Escape Exposed Platform-Wide Master Key (CVE-2026-66803)

> Wiz Research disclosed CosmosEscape, an exploit chain against Azure Cosmos DB's Gremlin query engine that escaped the query sandbox via .NET reflection abuse to gain arbitrary code execution on the multi-tenant DB Gateway. This exposed an unscoped platform-wide signing secret (the 'Cosmos Master Key') able to retrieve the primary key of any Cosmos DB account across all tenants, regions, and the SQL, MongoDB, Cassandra, and Gremlin APIs, plus a regional Config Store enabling attackers to enumerate and target specific organizations. Tracked as CVE-2026-66803 (CVSS 3.1: 10.0); Microsoft found no evidence of customer impact and completed a platform-wide fix eliminating the Master Key in July 2026.

- **Published:** 2026-07-30T00:00:00Z
- **Last reviewed:** 2026-07-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1779
- **ID:** TL-2026-1779
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-66803

## Description

Wiz Research disclosed CosmosEscape, a multi-stage exploit chain against Microsoft Azure Cosmos DB that allowed any standard Cosmos DB account holder — with no access to a victim tenant required — to break out of the service's Gremlin query sandbox and ultimately retrieve a single platform-wide signing secret capable of unlocking every customer database on the service.

Cosmos DB's proprietary Gremlin engine translates Gremlin graph queries into .NET code and enforces restrictions intended to keep queries confined to graph operations. Those restrictions did not sufficiently account for .NET reflection: Wiz researchers used reflection primitives to invoke .NET Native APIs directly, building file read, file write, and ultimately arbitrary code execution capabilities from within the query sandbox — a reflective code-loading pattern that let execution occur without following the engine's intended query-to-graph-operation path. A proof-of-concept crafted query executed the `hostname` command against the DB Gateway — the multi-tenant, Service Fabric-hosted component that processes Gremlin queries for all tenants — demonstrating full remote code execution. The only prerequisite was an attacker-owned Cosmos DB Gremlin account (host, database, graph path, and primary key); no prior access to a target organization's tenant was needed. Wiz is withholding the exact malicious Gremlin query pending its Black Hat USA talk.

Code execution on the DB Gateway exposed a signing key Wiz dubbed the 'Cosmos Master Key.' Unlike normal Cosmos DB primary/secondary keys, which are scoped to a single account, this key was unscoped: it could retrieve the primary key of ANY Cosmos DB account on the service through publicly accessible endpoints, regardless of tenant, region, or API flavor (SQL, MongoDB, Cassandra, Gremlin) — because the DB Gateway itself had to reach customer databases using the target account's own primary key to service queries, and the Master Key was the mechanism that let it fetch that key for any account on demand. Because the compromised DB Gateway itself was the component enforcing network isolation policy, even private, network-isolated Cosmos DB accounts were exposed. The Master Key also unlocked the Config Store — a regional Cosmos DB database, itself queryable via the SQL engine, that functions as the master directory of every account on the service, containing account names, subscription IDs, tenant IDs, network settings, and tags — letting an attacker enumerate and filter targets by organization before retrieving that organization's key and gaining full read-write access to its databases (a cloud-infrastructure-discovery step feeding directly into a cloud-storage data-collection step).

Because internal Microsoft services including Entra ID, Teams, and Copilot store data in Cosmos DB, their databases were potentially reachable through the same chain, raising the possibility of exposure of Teams message data and Copilot conversation histories. Microsoft states its investigation of access logs found no evidence any of this occurred outside Wiz's authorized, controlled testing, and that no customer action is required.

Wiz reported CosmosEscape to Microsoft via coordinated disclosure on 2025-11-20. Microsoft blocked the vulnerable Gremlin entry point within 48 hours and completed a platform-wide architectural remediation across all regions in July 2026, eliminating the Cosmos Master Key entirely and introducing stronger service-to-service authentication, new network protections, and additional monitoring. Microsoft published the initial MSRC Security Update Guide entry for CVE-2026-66803 at 7:00 a.m. Pacific on 2026-07-30 with no CVSS base score and only sparse technical detail, ahead of NVD enrichment the same day, which recorded a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CWE-284 (Improper Access Control). Wiz published its technical write-up the same day, bylined by Wiz Research's Yuval Avrahami and Lior Maman, and plans to present the complete exploit chain at Black Hat USA on 2026-08-06.

CosmosEscape is the third major Wiz/third-party-disclosed Cosmos DB security incident. ChaosDB (reported 2021-08-12, publicly disclosed 2021-08-26), discovered by Wiz Research's Nir Ohfeld and Sagi Tzadik, abused the Cosmos DB Jupyter Notebook feature to grant any Azure user unauthorized full admin access to other customers' Cosmos DB accounts. CosMiss (reported 2022-10-03, fixed within two days, publicly disclosed 2022-11-01), discovered by Orca Security — not Wiz — exploited missing authentication on the same Jupyter Notebook feature to allow unauthenticated read/write access and remote shell execution given only a notebook's forwarding ID. CosmosEscape is technically distinct from both: it targets the Gremlin query engine and DB Gateway rather than the Jupyter Notebook surface, but continues a pattern of platform-level, service-side control-plane failures in Cosmos DB's multi-tenant architecture.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1620 Reflective Code Loading
- T1552 Unsecured Credentials
- T1078.004 Cloud Accounts
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1087.004 Cloud Account
- T1550.001 Application Access Token
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1565.001 Stored Data Manipulation

## Sources

- [CosmosEscape: Taking Over Every Azure Cosmos DB](https://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db)
- [Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database](https://thehackernews.com/2026/07/azure-cosmos-db-flaw-exposed-platform.html)
- [MSRC Security Update Guide — CVE-2026-66803](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66803)
- [NVD — CVE-2026-66803 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-66803)
- [New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances](https://cybersecuritynews.com/cosmosescape-vulnerability/)
- [Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover](https://hackread.com/microsoft-cosmosescape-flaw-cosmos-db-takeover/)
- [CosmosEscape: Wiz Research Breached Azure Cosmos DB Gateway, Extracted Key to Every Database](https://www.techtimes.com/articles/322337/20260730/cosmosescape-wiz-research-breached-azure-cosmos-db-gateway-extracted-key-every-database.htm)
- [Microsoft Flags Azure Cosmos DB RCE Vulnerability; Here's What You Need to Do Now](https://windowsnews.ai/article/microsoft-flags-azure-cosmos-db-rce-vulnerability-heres-what-you-need-to-do-now.441050)
- [How we broke the cloud with two lines of code: the full story of ChaosDB](https://www.wiz.io/blog/how-we-broke-the-cloud-with-two-lines-of-code-the-full-story-of-chaosdb)
- [CosMiss: Azure Cosmos DB Notebook Remote Code Execution Vulnerability](https://orca.security/resources/blog/cosmiss-vulnerability-azure-cosmos-db/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1779