Threat reportVulnerabilityTL-2026-1802
CosmosEscape: Gremlin API Sandbox Escape Exposed Platform-Wide Key for Every Azure Cosmos DB Database
CosmosEscape (TL-2026-1802), also tracked as CosmosEscape, is a critical-severity software vulnerability, first published 2026-07-31. It has no confirmed attribution, affects Microsoft Azure Cosmos DB (Gremlin API), maps to 15 MITRE ATT&CK techniques (T1059, T1068, T1190), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-1802
- Threat ID
- TL-2026-1802
- Also known as
- CosmosEscape
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud-services, government administration, finance, health, enterprise-saas, cross-sector
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in CosmosEscape
Malware and tooling: Apache TinkerPop Gremlin
How CosmosEscape works
Wiz Research discovered CosmosEscape, a vulnerability chain in Azure Cosmos DB's Gremlin API that used unrestricted .NET reflection to escape the query sandbox, achieve arbitrary code execution on the multi-tenant DB Gateway, and retrieve a platform-wide 'Cosmos Master Key' capable of unlocking any customer's Cosmos DB account across every API surface. Microsoft hotfixed the entry point within 48 hours of the November 2025 report and completed an architectural fix eliminating the master key across all regions by July 2026, with no evidence of exploitation beyond Wiz's own testing.
CosmosEscape is a multi-stage vulnerability chain disclosed by Wiz Research in a July 30, 2026 blog post ('CosmosEscape: Taking Over Every Database in Azure Cosmos DB'), affecting Microsoft Azure Cosmos DB — Microsoft's flagship globally-distributed NoSQL database service. The chain began when Wiz researchers, experimenting with Cosmos DB's Gremlin graph-query API using only a standard, self-provisioned Azure account, noticed an unusual .NET exception. This revealed that unlike typical Gremlin implementations (which run atop the Java Virtual Machine using Apache TinkerPop), Cosmos DB compiles Gremlin queries into .NET code executed inside a sandbox intended to restrict operations to graph-traversal semantics. That sandbox enforced restrictions on Gremlin operations but did not adequately account for .NET reflection, letting the researchers craft queries against their own database that built file-read, file-write, and ultimately arbitrary code-execution primitives — demonstrated by executing the `hostname` OS command on Cosmos DB backend infrastructure.
This sandbox escape gave the researchers code execution on the DB Gateway, the multi-tenant service that executes every customer's queries on Azure Service Fabric clusters shared across tenants and regions. From that foothold, they found that the DB Gateway itself held credentials to a signing key — which Wiz dubbed the 'Cosmos Master Key' — used to retrieve any account's primary key. Critically, this key was not scoped to a single tenant, region, or API flavor: it worked across SQL, MongoDB, Cassandra, and Gremlin APIs platform-wide, and could be invoked through publicly accessible endpoints. Because compromise occurred inside the shared gateway rather than at any individual tenant boundary, even privately-networked and network-isolated Cosmos DB accounts were exposed — the isolation controls that were supposed to protect them did not extend to the gateway layer itself.
Using the master key, the researchers additionally accessed the Config Store, a regional directory recording every Cosmos DB account's name, subscription ID, tenant ID, network configuration, and tags. Because the Config Store is itself implemented as a Cosmos DB database, it could be queried with the full expressive power of Cosmos DB's SQL engine — enabling attackers to enumerate every account in a region or filter directly by a target organization's subscription or tenant ID, turning a theoretical platform-wide key into a practical, targeted takeover capability against any named customer. Wiz verified this reach extended to Microsoft's own internal Cosmos DB-backed services, including databases supporting Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot, observing access to thousands of Microsoft-internal databases within a single region/tenant during testing.
Wiz reported CosmosEscape to Microsoft on November 20, 2025; Microsoft acknowledged the same day and deployed a hotfix blocking the vulnerable Gremlin entry point within 48 hours (November 22, 2025), while beginning work on a long-term architectural fix. That fix — which eliminated the Cosmos Master Key entirely in favor of a hardened authentication architecture with new guardrails and enhanced monitoring — completed rollout across all Azure regions by July 2026. Microsoft states it found no evidence of unauthorized activity beyond Wiz's own authorized testing and that no customer data was accessed; no customer action is required. No CVE or MSRC case number has been publicly assigned. Wiz plans to present the full exploit chain at Black Hat USA 2026 on August 6, 2026 ('One Key to Rule Them All: Taking Over a Flagship Cloud Service'). CosmosEscape is the third Wiz-discovered Cosmos DB tenant-isolation-class flaw after ChaosDB (2021, Jupyter Notebook feature, cross-tenant admin access) and CosMiss (2022, also Jupyter Notebook-related), underscoring a recurring architectural risk pattern in Cosmos DB's shared-service design.
MITRE ATT&CK techniques used in TL-2026-1802
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Discovery
T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery; T1619 Cloud Storage Object Discovery
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Impact
Resource Development
defense-impairment
Affected products and versions in CosmosEscape
- Microsoft — Azure Cosmos DB (Gremlin API)
Vulnerable versions: Gremlin API / DB Gateway service, all Cosmos DB accounts prior to the 2025-11-22 hotfix
Fixed in: Gremlin API entry point post-2025-11-22 hotfix; full architectural fix (Cosmos Master Key elimination) across all Azure regions by July 2026 - Microsoft — Azure Cosmos DB (SQL, MongoDB, Cassandra APIs)
Vulnerable versions: All accounts platform-wide, indirectly exposed via the cross-API Cosmos Master Key even though the sandbox escape entry vector was Gremlin-specific
Fixed in: Post architectural fix, July 2026
Remediation for CosmosEscape
Patches
- Gremlin API entry-point hotfix, deployed 2025-11-22 (within 48 hours of the 2025-11-20 report).
- Full architectural remediation (Cosmos Master Key elimination) rolled out across all Azure regions by July 2026.
Immediate actions
- Microsoft-side: block the vulnerable Gremlin API entry point that permitted .NET reflection-based sandbox escape (deployed as a hotfix within 48 hours of disclosure).
- Customers: no customer action required per Microsoft; however, Cosmos DB customers with heightened risk tolerance should regenerate primary/secondary keys as a precaution given the historical pattern of Cosmos DB tenant-isolation flaws (ChaosDB, CosMiss, CosmosEscape).
- Audit Cosmos DB diagnostic logs for anomalous Gremlin queries, especially any referencing .NET reflection APIs, System.Reflection namespaces, or unexpected process/command execution artifacts.
Workarounds
- None required from customers; Microsoft states the fix is fully server-side and transparent to customers.
Longer-term hardening
- Microsoft completed an architectural fix eliminating the platform-wide 'Cosmos Master Key' entirely, replacing it with a hardened, properly-scoped authentication architecture.
- Microsoft implemented new guardrails around the Gremlin query-to-.NET compilation path to prevent reflection-based sandbox escapes.
- Microsoft enhanced monitoring and detection capabilities around the DB Gateway and Config Store.
- Customers should apply defense-in-depth for managed database services: never assume DBaaS sandbox/query engines provide airtight isolation from the underlying multi-tenant control plane; treat 'network isolation' and 'private endpoint' features as complementary to, not a substitute for, provider-side isolation guarantees.
Weaknesses (CWE) in CosmosEscape
Timeline of CosmosEscape
- Wiz Research discloses ChaosDB, a prior Cosmos DB tenant-isolation vulnerability in the Jupyter Notebook feature granting cross-tenant admin access — establishing a pattern of Cosmos DB multi-tenant isolation flaws later echoed by CosmosEscape.
- Microsoft notifies over 30% of Azure Cosmos DB customers of the ChaosDB exposure and advises regenerating primary keys.
- Wiz Research reports the CosmosEscape vulnerability chain (Gremlin sandbox escape leading to Cosmos Master Key exposure) to Microsoft; Microsoft acknowledges the report the same day.
- Microsoft deploys a hotfix blocking the vulnerable Gremlin API entry point within 48 hours of disclosure and begins developing a long-term architectural fix.
- Microsoft completes rollout of the long-term architectural fix eliminating the platform-wide Cosmos Master Key across all Azure regions (source states 'July 2026' at month-level precision; exact day not specified).
- Wiz Research publishes the public technical blog post 'CosmosEscape: Taking Over Every Database in Azure Cosmos DB', disclosing the full vulnerability chain.
- SecurityWeek and other outlets report on the CosmosEscape disclosure and Microsoft's completed remediation.
- Wiz Research is scheduled to present the complete CosmosEscape exploit chain at Black Hat USA 2026 in a talk titled 'One Key to Rule Them All: Taking Over a Flagship Cloud Service.'
Sources cited for CosmosEscape
- Critical Flaw Led to Azure Cosmos DB Pwnage
- CosmosEscape: Taking Over Every Database in Azure Cosmos DB
- Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database
- New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances
- CosmosEscape: Wiz Research Breached Azure Cosmos DB Gateway, Extracted Key to Every Database
- Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover
- CosmosEscape Vulnerability Enables Full Takeover of Azure Cosmos DB Databases
- CosmosEscape allowed the takeover of all Microsoft Azure databases
- Critical Azure Cosmos DB flaw risked cross-tenant compromise
- Microsoft Says Azure Cosmos DB Flaw Is Fixed After Wiz Discloses Cross-Tenant Exposure Risk
- ChaosDB: Unauthorized Privileged Access to Microsoft Azure Cosmos DB
- ChaosDB explained: Azure's Cosmos DB vulnerability walkthrough
- ChaosDB vulns saw Wiz researchers utterly pwn Azure Cosmos
Detection coverage for TL-2026-1802
As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1802 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.