CosmosEscape: Gremlin API Sandbox Escape Exposed Platform-Wide Key for Every Azure Cosmos DB Database — Threadlinqs Intelligence
As of 2026-07-31, CosmosEscape: Gremlin API Sandbox Escape Exposed Platform-Wide Key for Every Azure Cosmos DB Database is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1802 · Severity: CRITICAL · Status: PATCHED · Category: VULNERABILITY
Wiz Research discovered CosmosEscape, a vulnerability chain in Azure Cosmos DB's Gremlin API that used unrestricted .NET reflection to escape the query sandbox, achieve arbitrary code execution on the
CosmosEscape is a multi-stage vulnerability chain disclosed by Wiz Research in a July 30, 2026 blog post ('CosmosEscape: Taking Over Every Database in Azure Cosmos DB'), affecting Microsoft Azure Cosmos DB — Microsoft's flagship globally-distributed NoSQL database service. The chain began when Wiz researchers, experimenting with Cosmos DB's Gremlin graph-query API using only a standard, self-provisioned Azure account, noticed an unusual .NET exception. This revealed that unlike typical Gremlin implementations (which run atop the Java Virtual Machine using Apache TinkerPop), Cosmos DB compiles Gremlin queries into .NET code executed inside a sandbox intended to restrict operations to graph-traversal semantics. That sandbox enforced restrictions on Gremlin operations but did not adequately account for .NET reflection, letting the researchers craft queries against their own database that built file-read, file-write, and ultimately arbitrary code-execution primitives — demonstrated by executing the `hostname` OS command on Cosmos DB backend infrastructure.
This sandbox escape gave the researchers code execution on the DB Gateway, the multi-tenant service that executes every customer's queries on Azure Service Fabric clusters shared across tenants and regions. From that foothold, they found that the DB Gateway itself held credentials to a signing key — which Wiz dubbed the 'Cosmos Master Key' — used to retrieve any account's primary key. Critically, this key was not scoped to a single tenant, region, or API flavor: it worked across SQL, MongoDB, Cassandra, and Gremlin APIs platform-wide, and could be invoked through publicly accessible endpoints. Because compromise occurred inside the shared gateway rather than at any individual tenant boundary, even privately-networked and network-isolated Cosmos DB accounts were exposed — the isolation controls that were supposed to protect them did not extend to the gateway layer itself.
Using the master key, the researchers additionally accessed the Config Store, a regional directory recording every Cosmos DB account's name, subscription ID, tenant ID, network configuration, and tags. Because the Config Store is itself implemented as a Cosmos DB database, it could be queried with the full expressive power of Cosmos DB's SQL engine — enabling attackers to enumerate every account in a region or filter directly by a target organization's subscription or tenant ID, turning a theoretical platform-wide key into a practical, targeted takeover capability against any named customer. Wiz verified this reach extended to Microsoft's own internal Cosmos DB-backed services, including databases supporting Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot, observing access to thousands of Microsoft-internal databases within a single region/tenant during testing.
Wiz reported CosmosEscape to Microsoft on November 20, 2025; Microsoft acknowledged the same day and deployed a hotfix blocking the vulnerable Gremlin entry point within 48 hours (November 22, 2025), while beginning work on a long-term architectural fix. That fix — which eliminated the Cosmos Master Key entirely in favor of a hardened authentication architecture with new guardrails and enhanced monitoring — completed rollout across all Azure regions by July 2026. Microsoft states it found no evidence of unauthorized activity beyond Wiz's own authorized testing and that no customer data was accessed; no customer action is required. No CVE or MSRC case number has been publicly assigned. Wiz plans to present the full exploit chain at Black Hat USA 2026 on August 6, 2026 ('One Key to Rule Them All: Taking Over a Flagship Cloud Service'). CosmosEscape is the third Wiz-discovered Cosmos DB tenant-isolation-class flaw after ChaosDB (2021, Jupyter Notebook feature, cross-tenant admin access) and CosMiss (2022, also Jupyter Notebook-related), underscoring a recurring architectural risk pattern in Cosmos DB's shared-service design.
Weaknesses (CWE)
CWE-470, CWE-284, CWE-668, CWE-269
Target sectors: technology, cloud-services, government administration, finance, health, enterprise-saas, cross-sector
Target regions: Global
Detections & IOCs
As of 2026-08-10, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1585, T1190, T1059, T1068, T1611, T1599, T1528, T1552, T1526, T1580
