CosmosEscape: Platform-Wide Cosmos Master Key Exposure via Gremlin API Sandbox Escape in Azure Cosmos DB — Threadlinqs Intelligence
As of 2026-07-31, CosmosEscape: Platform-Wide Cosmos Master Key Exposure via Gremlin API Sandbox Escape in Azure Cosmos DB is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-1784 · Severity: CRITICAL · Status: PATCHED · Category: VULNERABILITY
Wiz Research discovered CosmosEscape, an unpatched vulnerability chain in Azure Cosmos DB's custom Gremlin query engine that let any standard Cosmos DB account holder abuse .NET reflection to escape
CosmosEscape is a multi-stage vulnerability chain in Microsoft Azure Cosmos DB, reported by Wiz Research (with early assistance from Wiz's in-development AI vulnerability-research tool, 'Atlas') and disclosed publicly on July 30, 2026, with a full technical breakdown scheduled for a Black Hat USA 2026 briefing titled 'One Key to Rule Them All: Taking Over a Flagship Cloud Service.'
The chain began when researchers noticed an unusual .NET exception while experimenting with Cosmos DB's Gremlin graph-query API. That exception revealed that, unlike a standard JVM-based Apache TinkerPop Gremlin implementation, Cosmos DB runs a custom engine that translates Gremlin graph queries directly into executable .NET code inside a restricted sandbox. The sandbox's restrictions did not adequately account for .NET reflection — a runtime feature that lets code inspect and invoke other code — and researchers used reflection-based primitives to build file-read, file-write, and ultimately arbitrary code execution capability, purely through crafted Gremlin queries issued against a database the researchers themselves owned. As proof, they executed the `hostname` command directly on the backend.
The code execution landed on the DB Gateway, a multi-tenant service built on Azure Service Fabric that brokers and authenticates every customer query regardless of which API (SQL, MongoDB, Cassandra, or Gremlin) issued it. From that foothold, researchers found the DB Gateway held a platform-wide signing key — the 'Cosmos Master Key' — that was not scoped to any single account, tenant, region, or API type. Presenting that key to Cosmos DB's control plane returned the primary key of any target account, granting full administrative, cross-tenant, data-plane read/write access — including the ability to read, modify, or delete customer data.
A second discovery compounded the impact: Cosmos DB's Config Store, the regional directory of account metadata (account names, subscription IDs, tenant IDs, network configuration, and tags), is itself implemented as a Cosmos DB SQL-API database. Using the same code-execution foothold, researchers could query the Config Store with full SQL flexibility, filtering by tenant ID to precisely enumerate and target specific organizations at platform scale. Because the compromised DB Gateway is also the component responsible for enforcing network isolation, private and network-restricted Cosmos DB accounts were not protected from this path, and Config Store write access created a theoretical route to durably weaken an account's network isolation settings.
Microsoft's Entra ID, Microsoft Teams, and Microsoft Copilot all store data in Cosmos DB, meaning the exposure chain had a plausible blast radius reaching well beyond direct Cosmos DB customers into core Microsoft 365 identity, messaging, and AI-assistant data. Wiz reported the issue to Microsoft on November 20, 2025; Microsoft acknowledged the same day and deployed a hotfix blocking the vulnerable Gremlin entry point within 48 hours (November 22, 2025). Microsoft then completed a longer-term architectural fix — eliminating the platform-wide Cosmos Master Key entirely and hardening service-to-service authentication — across all Azure regions by July 2026. Microsoft's review of access logs found no evidence of exploitation beyond Wiz's own authorized testing, and stated no customer data was accessed. No CVE identifier or CVSS score has been assigned. CosmosEscape is technically distinct from, but part of the same lineage as, two earlier Cosmos DB flaws: ChaosDB (2021) and CosMiss (2022), both of which involved the Jupyter Notebook feature rather than the Gremlin query engine.
Weaknesses (CWE)
CWE-470, CWE-284, CWE-668, CWE-522
Target sectors: technology, government administration, financial-services, health, cloud-service-providers, enterprise-saas, telecoms, critical-infrastructure
Target regions: Global
Detections & IOCs
As of 2026-08-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1595.002, T1190, T1059, T1098, T1548, T1611, T1611, T1552, T1528, T1580
