Threat reportVulnerabilityTL-2026-1784
CosmosEscape: Platform-Wide Cosmos Master Key Exposure via Gremlin API Sandbox Escape in Azure Cosmos DB
CosmosEscape (TL-2026-1784), also tracked as CosmosEscape, is a critical-severity software vulnerability, first published 2026-07-31. It has no confirmed attribution, affects Microsoft Azure Cosmos DB — Gremlin API, maps to 16 MITRE ATT&CK techniques (T1059, T1078.004, T1098), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-1784
- Threat ID
- TL-2026-1784
- Also known as
- CosmosEscape
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, financial-services, health, cloud-service-providers, enterprise-saas, telecoms, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in CosmosEscape
Malware and tooling: Atlas (Wiz AI Vulnerability Researcher, early version)
How CosmosEscape works
Wiz Research discovered CosmosEscape, an unpatched vulnerability chain in Azure Cosmos DB's custom Gremlin query engine that let any standard Cosmos DB account holder abuse .NET reflection to escape the query sandbox, achieve arbitrary code execution on the multi-tenant DB Gateway, and retrieve the platform-wide 'Cosmos Master Key' — a signing secret capable of pulling the primary key for any customer account across every tenant, region, and API surface (SQL, MongoDB, Cassandra, Gremlin). Microsoft deployed a hotfix within 48 hours of Wiz's November 20, 2025 report and completed a full architectural remediation eliminating the master key by July 2026; Microsoft found no evidence of malicious exploitation.
CosmosEscape is a multi-stage vulnerability chain in Microsoft Azure Cosmos DB, reported by Wiz Research (with early assistance from Wiz's in-development AI vulnerability-research tool, 'Atlas') and disclosed publicly on July 30, 2026, with a full technical breakdown scheduled for a Black Hat USA 2026 briefing titled 'One Key to Rule Them All: Taking Over a Flagship Cloud Service.'
The chain began when researchers noticed an unusual .NET exception while experimenting with Cosmos DB's Gremlin graph-query API. That exception revealed that, unlike a standard JVM-based Apache TinkerPop Gremlin implementation, Cosmos DB runs a custom engine that translates Gremlin graph queries directly into executable .NET code inside a restricted sandbox. The sandbox's restrictions did not adequately account for .NET reflection — a runtime feature that lets code inspect and invoke other code — and researchers used reflection-based primitives to build file-read, file-write, and ultimately arbitrary code execution capability, purely through crafted Gremlin queries issued against a database the researchers themselves owned. As proof, they executed the `hostname` command directly on the backend.
The code execution landed on the DB Gateway, a multi-tenant service built on Azure Service Fabric that brokers and authenticates every customer query regardless of which API (SQL, MongoDB, Cassandra, or Gremlin) issued it. From that foothold, researchers found the DB Gateway held a platform-wide signing key — the 'Cosmos Master Key' — that was not scoped to any single account, tenant, region, or API type. Presenting that key to Cosmos DB's control plane returned the primary key of any target account, granting full administrative, cross-tenant, data-plane read/write access — including the ability to read, modify, or delete customer data.
A second discovery compounded the impact: Cosmos DB's Config Store, the regional directory of account metadata (account names, subscription IDs, tenant IDs, network configuration, and tags), is itself implemented as a Cosmos DB SQL-API database. Using the same code-execution foothold, researchers could query the Config Store with full SQL flexibility, filtering by tenant ID to precisely enumerate and target specific organizations at platform scale. Because the compromised DB Gateway is also the component responsible for enforcing network isolation, private and network-restricted Cosmos DB accounts were not protected from this path, and Config Store write access created a theoretical route to durably weaken an account's network isolation settings.
Microsoft's Entra ID, Microsoft Teams, and Microsoft Copilot all store data in Cosmos DB, meaning the exposure chain had a plausible blast radius reaching well beyond direct Cosmos DB customers into core Microsoft 365 identity, messaging, and AI-assistant data. Wiz reported the issue to Microsoft on November 20, 2025; Microsoft acknowledged the same day and deployed a hotfix blocking the vulnerable Gremlin entry point within 48 hours (November 22, 2025). Microsoft then completed a longer-term architectural fix — eliminating the platform-wide Cosmos Master Key entirely and hardening service-to-service authentication — across all Azure regions by July 2026. Microsoft's review of access logs found no evidence of exploitation beyond Wiz's own authorized testing, and stated no customer data was accessed. No CVE identifier or CVSS score has been assigned. CosmosEscape is technically distinct from, but part of the same lineage as, two earlier Cosmos DB flaws: ChaosDB (2021) and CosMiss (2022), both of which involved the Jupyter Notebook feature rather than the Gremlin query engine.
MITRE ATT&CK techniques used in TL-2026-1784
Execution
T1059 Command and Scripting Interpreter
stealth
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Impact
T1485 Data Destruction; T1565.001 Stored Data Manipulation
Discovery
T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Privilege Escalation
T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host
Reconnaissance
T1595.002 Vulnerability Scanning
privilege-escalation
Affected products and versions in CosmosEscape
- Microsoft — Azure Cosmos DB — Gremlin API
Vulnerable versions: All Cosmos DB accounts reachable via the Gremlin API prior to the November 22, 2025 hotfix
Fixed in: Post-November 22, 2025 hotfix; fully remediated platform-wide by the July 2026 architectural fix - Microsoft — Azure Cosmos DB — SQL (Core) API
Vulnerable versions: Any account whose primary key could be retrieved via the exposed Cosmos Master Key prior to remediation
Fixed in: Fully remediated by the July 2026 architectural fix (Cosmos Master Key eliminated) - Microsoft — Azure Cosmos DB — MongoDB API
Vulnerable versions: Any account whose primary key could be retrieved via the exposed Cosmos Master Key prior to remediation
Fixed in: Fully remediated by the July 2026 architectural fix (Cosmos Master Key eliminated) - Microsoft — Azure Cosmos DB — Cassandra API
Vulnerable versions: Any account whose primary key could be retrieved via the exposed Cosmos Master Key prior to remediation
Fixed in: Fully remediated by the July 2026 architectural fix (Cosmos Master Key eliminated) - Microsoft — Azure Cosmos DB — DB Gateway (Service Fabric multi-tenant component)
Vulnerable versions: DB Gateway builds prior to the November 22, 2025 hotfix
Fixed in: Hardened DB Gateway with scoped, service-to-service authenticated key retrieval post-July 2026 - Microsoft — Microsoft Entra ID (Cosmos DB-backed data store)
Vulnerable versions: Indirectly exposed via shared Cosmos DB backend prior to remediation
Fixed in: Protected as of the completed Cosmos DB architectural fix - Microsoft — Microsoft Teams (Cosmos DB-backed message storage)
Vulnerable versions: Indirectly exposed via shared Cosmos DB backend prior to remediation
Fixed in: Protected as of the completed Cosmos DB architectural fix - Microsoft — Microsoft Copilot (Cosmos DB-backed conversation history)
Vulnerable versions: Indirectly exposed via shared Cosmos DB backend prior to remediation
Fixed in: Protected as of the completed Cosmos DB architectural fix
Remediation for CosmosEscape
Patches
- Hotfix blocking the vulnerable Gremlin API entry point (Microsoft, November 22, 2025)
- Full architectural fix rolled out across all Azure regions (Microsoft, completed July 2026)
Immediate actions
- Microsoft-deployed hotfix blocking the vulnerable Gremlin API entry point (live November 22, 2025, within 48 hours of report)
- Cosmos Master Key fully eliminated from the platform architecture — no platform-wide signing key remains
- No customer-side action required per Microsoft; fix is entirely server-side and platform-managed
Workarounds
- None required or available on the customer side; Microsoft confirmed the vulnerability is fully remediated platform-side with no residual customer exposure
Longer-term hardening
- Architectural migration of Cosmos DB's key-retrieval model away from any platform-wide/unscoped signing secret
- Hardened service-to-service authentication between the DB Gateway and backend control-plane services
- Additional network protections, monitoring, and detection capabilities deployed across all Azure Cosmos DB regions
- Restrictions tightening how Gremlin query translation exposes .NET reflection primitives to prevent recurrence of the sandbox-escape class of bug
Weaknesses (CWE) in CosmosEscape
Timeline of CosmosEscape
- Wiz Research discovers ChaosDB, an earlier Cosmos DB vulnerability chain in the Jupyter Notebook feature (distinct attack surface from Gremlin, but the same broad vulnerability lineage as CosmosEscape).
- Wiz Research reports ChaosDB to Microsoft.
- Microsoft disables the vulnerable Jupyter Notebook feature underlying ChaosDB as an interim mitigation.
- Wiz Research and Microsoft publicly disclose ChaosDB, the first in the lineage of Cosmos DB platform-wide credential-exposure vulnerabilities that CosmosEscape continues.
- The CosMiss vulnerability — missing authentication on Cosmos DB's Jupyter Notebook workspace forwarding IDs, also part of the same Cosmos DB vulnerability lineage — is introduced, per Orca Security's later root-cause analysis.
- Orca Security reports the CosMiss vulnerability to Microsoft.
- Microsoft fixes the CosMiss flaw worldwide within two days of Orca Security's report.
- Orca Security publicly discloses full technical details of CosMiss.
- Microsoft acknowledges receipt of Wiz's report the same day.
- Wiz Research reports the CosmosEscape vulnerability chain to Microsoft.
- Microsoft begins the longer-term architectural remediation work to eliminate the platform-wide Cosmos Master Key.
- Microsoft deploys a hotfix blocking the vulnerable Gremlin API entry point, within 48 hours of the initial report.
- Microsoft completes the full architectural fix across all Azure regions; the Cosmos Master Key no longer exists in Cosmos DB's architecture.
- Wiz Research publicly discloses CosmosEscape via its research blog; coverage follows from The Hacker News, GBHackers, Hackread, TechTimes, SC Media, and CyberSecurityNews.
- Wiz Research is scheduled to present the full exploit chain, including the crafted Gremlin query that initiated the sandbox escape, at Black Hat USA 2026 in a briefing titled 'One Key to Rule Them All: Taking Over a Flagship Cloud Service.'
Sources cited for CosmosEscape
- CosmosEscape Vulnerability
- CosmosEscape: Taking Over Every Database in Azure Cosmos DB
- Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database
- Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover
- CosmosEscape: Wiz Research Breached Azure Cosmos DB Gateway, Extracted Key to Every Database
- Critical Azure Cosmos DB flaw risked cross-tenant compromise
- New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances
- Critical Vulnerability in Microsoft Azure Cosmos DB Opens Up Jupyter Notebooks (ChaosDB, related prior Cosmos DB flaw)
- ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough
- CosMiss: Azure Cosmos DB Vulnerability
- Researchers Disclose Details of Critical 'CosMiss' RCE Flaw Affecting Azure Cosmos DB
Detection coverage for TL-2026-1784
As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1784 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.