# CosmosEscape: Platform-Wide Cosmos Master Key Exposure via Gremlin API Sandbox Escape in Azure Cosmos DB

> Wiz Research discovered CosmosEscape, an unpatched vulnerability chain in Azure Cosmos DB's custom Gremlin query engine that let any standard Cosmos DB account holder abuse .NET reflection to escape the query sandbox, achieve arbitrary code execution on the multi-tenant DB Gateway, and retrieve the platform-wide 'Cosmos Master Key' — a signing secret capable of pulling the primary key for any customer account across every tenant, region, and API surface (SQL, MongoDB, Cassandra, Gremlin). Microsoft deployed a hotfix within 48 hours of Wiz's November 20, 2025 report and completed a full architectural remediation eliminating the master key by July 2026; Microsoft found no evidence of malicious exploitation.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1784
- **ID:** TL-2026-1784
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CosmosEscape is a multi-stage vulnerability chain in Microsoft Azure Cosmos DB, reported by Wiz Research (with early assistance from Wiz's in-development AI vulnerability-research tool, 'Atlas') and disclosed publicly on July 30, 2026, with a full technical breakdown scheduled for a Black Hat USA 2026 briefing titled 'One Key to Rule Them All: Taking Over a Flagship Cloud Service.'

The chain began when researchers noticed an unusual .NET exception while experimenting with Cosmos DB's Gremlin graph-query API. That exception revealed that, unlike a standard JVM-based Apache TinkerPop Gremlin implementation, Cosmos DB runs a custom engine that translates Gremlin graph queries directly into executable .NET code inside a restricted sandbox. The sandbox's restrictions did not adequately account for .NET reflection — a runtime feature that lets code inspect and invoke other code — and researchers used reflection-based primitives to build file-read, file-write, and ultimately arbitrary code execution capability, purely through crafted Gremlin queries issued against a database the researchers themselves owned. As proof, they executed the `hostname` command directly on the backend.

The code execution landed on the DB Gateway, a multi-tenant service built on Azure Service Fabric that brokers and authenticates every customer query regardless of which API (SQL, MongoDB, Cassandra, or Gremlin) issued it. From that foothold, researchers found the DB Gateway held a platform-wide signing key — the 'Cosmos Master Key' — that was not scoped to any single account, tenant, region, or API type. Presenting that key to Cosmos DB's control plane returned the primary key of any target account, granting full administrative, cross-tenant, data-plane read/write access — including the ability to read, modify, or delete customer data.

A second discovery compounded the impact: Cosmos DB's Config Store, the regional directory of account metadata (account names, subscription IDs, tenant IDs, network configuration, and tags), is itself implemented as a Cosmos DB SQL-API database. Using the same code-execution foothold, researchers could query the Config Store with full SQL flexibility, filtering by tenant ID to precisely enumerate and target specific organizations at platform scale. Because the compromised DB Gateway is also the component responsible for enforcing network isolation, private and network-restricted Cosmos DB accounts were not protected from this path, and Config Store write access created a theoretical route to durably weaken an account's network isolation settings.

Microsoft's Entra ID, Microsoft Teams, and Microsoft Copilot all store data in Cosmos DB, meaning the exposure chain had a plausible blast radius reaching well beyond direct Cosmos DB customers into core Microsoft 365 identity, messaging, and AI-assistant data. Wiz reported the issue to Microsoft on November 20, 2025; Microsoft acknowledged the same day and deployed a hotfix blocking the vulnerable Gremlin entry point within 48 hours (November 22, 2025). Microsoft then completed a longer-term architectural fix — eliminating the platform-wide Cosmos Master Key entirely and hardening service-to-service authentication — across all Azure regions by July 2026. Microsoft's review of access logs found no evidence of exploitation beyond Wiz's own authorized testing, and stated no customer data was accessed. No CVE identifier or CVSS score has been assigned. CosmosEscape is technically distinct from, but part of the same lineage as, two earlier Cosmos DB flaws: ChaosDB (2021) and CosMiss (2022), both of which involved the Jupyter Notebook feature rather than the Gremlin query engine.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1548 Abuse Elevation Control Mechanism
- T1611 Escape to Host
- T1611 Escape to Host
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1580 Cloud Infrastructure Discovery
- T1526 Cloud Service Discovery
- T1210 Exploitation of Remote Services
- T1078.004 Cloud Accounts
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1565.001 Stored Data Manipulation
- T1485 Data Destruction

## Sources

- [CosmosEscape Vulnerability](https://gbhackers.com/cosmosescape-vulnerability/)
- [CosmosEscape: Taking Over Every Database in Azure Cosmos DB](https://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db)
- [Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database](https://thehackernews.com/2026/07/azure-cosmos-db-flaw-exposed-platform.html)
- [Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover](https://hackread.com/microsoft-cosmosescape-flaw-cosmos-db-takeover/)
- [CosmosEscape: Wiz Research Breached Azure Cosmos DB Gateway, Extracted Key to Every Database](https://www.techtimes.com/articles/322337/20260730/cosmosescape-wiz-research-breached-azure-cosmos-db-gateway-extracted-key-every-database.htm)
- [Critical Azure Cosmos DB flaw risked cross-tenant compromise](https://www.scworld.com/news/microsoft-patches-azure-cosmos-db-stopping-widespread-cross-service-attack)
- [New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances](https://cybersecuritynews.com/cosmosescape-vulnerability/)
- [Critical Vulnerability in Microsoft Azure Cosmos DB Opens Up Jupyter Notebooks (ChaosDB, related prior Cosmos DB flaw)](https://www.darkreading.com/application-security/critical-vulnerability-found-and-fixed-in-azure-cosmos-db-)
- [ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough](https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough)
- [CosMiss: Azure Cosmos DB Vulnerability](https://orca.security/resources/blog/cosmiss-vulnerability-azure-cosmos-db/)
- [Researchers Disclose Details of Critical 'CosMiss' RCE Flaw Affecting Azure Cosmos DB](https://thehackernews.com/2022/11/researchers-disclose-details-of.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1784