# CosmosEscape: Gremlin API Sandbox Escape Exposed Platform-Wide Key for Every Azure Cosmos DB Database

> Wiz Research discovered CosmosEscape, a vulnerability chain in Azure Cosmos DB's Gremlin API that used unrestricted .NET reflection to escape the query sandbox, achieve arbitrary code execution on the multi-tenant DB Gateway, and retrieve a platform-wide 'Cosmos Master Key' capable of unlocking any customer's Cosmos DB account across every API surface. Microsoft hotfixed the entry point within 48 hours of the November 2025 report and completed an architectural fix eliminating the master key across all regions by July 2026, with no evidence of exploitation beyond Wiz's own testing.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1802
- **ID:** TL-2026-1802
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CosmosEscape is a multi-stage vulnerability chain disclosed by Wiz Research in a July 30, 2026 blog post ('CosmosEscape: Taking Over Every Database in Azure Cosmos DB'), affecting Microsoft Azure Cosmos DB — Microsoft's flagship globally-distributed NoSQL database service. The chain began when Wiz researchers, experimenting with Cosmos DB's Gremlin graph-query API using only a standard, self-provisioned Azure account, noticed an unusual .NET exception. This revealed that unlike typical Gremlin implementations (which run atop the Java Virtual Machine using Apache TinkerPop), Cosmos DB compiles Gremlin queries into .NET code executed inside a sandbox intended to restrict operations to graph-traversal semantics. That sandbox enforced restrictions on Gremlin operations but did not adequately account for .NET reflection, letting the researchers craft queries against their own database that built file-read, file-write, and ultimately arbitrary code-execution primitives — demonstrated by executing the `hostname` OS command on Cosmos DB backend infrastructure.

This sandbox escape gave the researchers code execution on the DB Gateway, the multi-tenant service that executes every customer's queries on Azure Service Fabric clusters shared across tenants and regions. From that foothold, they found that the DB Gateway itself held credentials to a signing key — which Wiz dubbed the 'Cosmos Master Key' — used to retrieve any account's primary key. Critically, this key was not scoped to a single tenant, region, or API flavor: it worked across SQL, MongoDB, Cassandra, and Gremlin APIs platform-wide, and could be invoked through publicly accessible endpoints. Because compromise occurred inside the shared gateway rather than at any individual tenant boundary, even privately-networked and network-isolated Cosmos DB accounts were exposed — the isolation controls that were supposed to protect them did not extend to the gateway layer itself.

Using the master key, the researchers additionally accessed the Config Store, a regional directory recording every Cosmos DB account's name, subscription ID, tenant ID, network configuration, and tags. Because the Config Store is itself implemented as a Cosmos DB database, it could be queried with the full expressive power of Cosmos DB's SQL engine — enabling attackers to enumerate every account in a region or filter directly by a target organization's subscription or tenant ID, turning a theoretical platform-wide key into a practical, targeted takeover capability against any named customer. Wiz verified this reach extended to Microsoft's own internal Cosmos DB-backed services, including databases supporting Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot, observing access to thousands of Microsoft-internal databases within a single region/tenant during testing.

Wiz reported CosmosEscape to Microsoft on November 20, 2025; Microsoft acknowledged the same day and deployed a hotfix blocking the vulnerable Gremlin entry point within 48 hours (November 22, 2025), while beginning work on a long-term architectural fix. That fix — which eliminated the Cosmos Master Key entirely in favor of a hardened authentication architecture with new guardrails and enhanced monitoring — completed rollout across all Azure regions by July 2026. Microsoft states it found no evidence of unauthorized activity beyond Wiz's own authorized testing and that no customer data was accessed; no customer action is required. No CVE or MSRC case number has been publicly assigned. Wiz plans to present the full exploit chain at Black Hat USA 2026 on August 6, 2026 ('One Key to Rule Them All: Taking Over a Flagship Cloud Service'). CosmosEscape is the third Wiz-discovered Cosmos DB tenant-isolation-class flaw after ChaosDB (2021, Jupyter Notebook feature, cross-tenant admin access) and CosMiss (2022, also Jupyter Notebook-related), underscoring a recurring architectural risk pattern in Cosmos DB's shared-service design.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1599 Network Boundary Bridging
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1619 Cloud Storage Object Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1565 Data Manipulation

## Sources

- [Critical Flaw Led to Azure Cosmos DB Pwnage](https://www.securityweek.com/critical-flaw-led-to-azure-cosmos-db-pwnage/)
- [CosmosEscape: Taking Over Every Database in Azure Cosmos DB](https://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db)
- [Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database](https://thehackernews.com/2026/07/azure-cosmos-db-flaw-exposed-platform.html)
- [New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances](https://cybersecuritynews.com/cosmosescape-vulnerability/)
- [CosmosEscape: Wiz Research Breached Azure Cosmos DB Gateway, Extracted Key to Every Database](https://www.techtimes.com/articles/322337/20260730/cosmosescape-wiz-research-breached-azure-cosmos-db-gateway-extracted-key-every-database.htm)
- [Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover](https://hackread.com/microsoft-cosmosescape-flaw-cosmos-db-takeover/)
- [CosmosEscape Vulnerability Enables Full Takeover of Azure Cosmos DB Databases](https://gbhackers.com/cosmosescape-vulnerability/)
- [CosmosEscape allowed the takeover of all Microsoft Azure databases](https://www.heise.de/en/news/CosmosEscape-allowed-the-takeover-of-all-Microsoft-Azure-databases-11389043.html)
- [Critical Azure Cosmos DB flaw risked cross-tenant compromise](https://www.scworld.com/news/microsoft-patches-azure-cosmos-db-stopping-widespread-cross-service-attack)
- [Microsoft Says Azure Cosmos DB Flaw Is Fixed After Wiz Discloses Cross-Tenant Exposure Risk](https://www.cxodigitalpulse.com/microsoft-says-azure-cosmos-db-flaw-is-fixed-after-wiz-discloses-cross-tenant-exposure-risk/)
- [ChaosDB: Unauthorized Privileged Access to Microsoft Azure Cosmos DB](https://chaosdb.wiz.io/)
- [ChaosDB explained: Azure's Cosmos DB vulnerability walkthrough](https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough)
- [ChaosDB vulns saw Wiz researchers utterly pwn Azure Cosmos](https://www.theregister.com/2021/11/12/chaos_db_wiz_azure_cosmos_research_pwnage/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1802