{"slug": "cosmosescape-azure-cosmos-dbs-gremlin-sandbox-escape", "title": "CosmosEscape: Azure Cosmos DB’s Gremlin Sandbox Escape", "summary": "Wiz Research disclosed CosmosEscape, a chained vulnerability in Azure Cosmos DB's Gremlin API that allowed a researcher to execute arbitrary code on the shared Gateway and retrieve the primary key for any Cosmos DB account, affecting Microsoft Entra ID, Teams, and Copilot. Microsoft hotfixed the issue within 48 hours of the November 2025 report and completed an architectural fix in July 2026, with no evidence of exploitation. This is the third critical sandbox escape in Azure Cosmos DB in five years, following ChaosDB (2021) and CosMiss (2022).", "body_md": "On July 30, Wiz Research disclosed CosmosEscape: a chained vulnerability in Azure Cosmos DB’s Gremlin API where a researcher could craft a query against their own database and walk away with a key to everyone else’s. The blast radius included Microsoft Entra ID, Teams, and Copilot. A hotfix landed 48 hours after Wiz reported it in November 2025. The full architectural fix — eliminating the shared signing key that made this catastrophic — wrapped up last month. The full exploitation chain [goes public today at Black Hat USA](https://www.securityweek.com/critical-flaw-led-to-azure-cosmos-db-pwnage/).\n\n## How the Attack Worked\n\nAzure Cosmos DB’s Gremlin engine compiles graph queries into .NET code and runs them inside a sandboxed environment. The sandbox blocked specific Gremlin operations — but it did not restrict .NET reflection. That distinction matters: reflection is a runtime capability that lets code dynamically invoke arbitrary types and methods, bypassing the type-system checks the sandbox was built around.\n\nWiz researchers used reflection to build file-read and file-write primitives, then escalated to arbitrary code execution on the DB Gateway — the shared, multi-tenant Service Fabric clusters that process customer queries. The proof of concept was blunt: they ran `hostname`\n\non Cosmos DB’s backend infrastructure, through queries submitted to their own database, without touching any other customer’s account. The sandbox was already gone at that point.\n\n## The Key That Unlocked Everything\n\nOnce inside the Gateway, the researchers found what they named the Cosmos Master Key: a platform-wide signing credential that could retrieve the primary key for any Cosmos DB account on the service — across all tenants, all regions, and all API flavors (SQL, MongoDB, Cassandra, Gremlin) — through publicly accessible endpoints. Primary keys grant full read, write, and delete control over everything in an account.\n\nThe Gateway also had access to a Config Store: a queryable directory containing every Cosmos DB account name, subscription ID, tenant ID, and network configuration. One region’s index alone held thousands of Microsoft-internal databases. An attacker with the Master Key and the Config Store could enumerate targets by organization, filter by region, and retrieve primary keys for precision-targeted attacks — all from a standard Azure account they controlled.\n\n## The Blast Radius\n\nCustomer databases were the obvious target. Less obvious: the attack path reached Microsoft’s own infrastructure. Entra ID, Teams, and Copilot all use Cosmos DB on the backend. Network isolation did not help — isolation policies are enforced at the account layer; this attack ran through the Gateway layer above it. Private and network-isolated accounts were just as reachable as public ones.\n\nMicrosoft confirmed no evidence of exploitation before the November 2025 disclosure, and no customer action is required. The [patching was entirely server-side](https://thehackernews.com/2026/07/azure-cosmos-db-flaw-exposed-platform.html).\n\n## The Third Time\n\nCosmosEscape is the third critical sandbox escape from Azure Cosmos DB in five years:\n\n**ChaosDB (2021):** Wiz exploited a Server-Side Request Forgery flaw in Cosmos DB’s Jupyter Notebook feature — enabled by default — to access cross-tenant databases.[Microsoft patched in 48 hours.](https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough)**CosMiss (2022):** Orca Security found unauthenticated remote code execution in Cosmos DB Notebooks. Patched in two days.**CosmosEscape (2025):** Wiz found .NET reflection in the Gremlin engine escapes the sandbox and reaches a platform-wide signing key. Microsoft hotfixed in 48 hours, completed architectural overhaul in July 2026.\n\nDifferent entry points, same pattern: a sandbox that did not account for all execution primitives, sitting adjacent to shared credentials. “No customer action required” was true each time — but framing that as a clean outcome ignores the structural issue. Three escapes from the same service suggests the sandbox architecture needed a fundamental rethink, not incremental patching. The July 2026 overhaul — eliminating the platform-wide key — looks like Microsoft finally agreeing.\n\n## An AI Found This\n\nThree days before the CosmosEscape disclosure, Wiz publicly launched [Atlas](https://www.wiz.io/blog/atlas-ai-vulnerability-researcher): their autonomous AI vulnerability research system. CosmosEscape is the first publicly confirmed critical cloud infrastructure vulnerability where Atlas assisted in discovery.\n\nAtlas is not a single model. It runs as a multi-agent pipeline: threat modeling, parallel hypothesis testing, adversarial validation between competing agents, and dynamic proof executed in an isolated environment. It ranked first on the CyberGym benchmark with a 90.9% success rate. It has found more than 200 previously unknown vulnerabilities in some of the most-audited codebases on the planet — Linux kernel, Kubernetes, gRPC, containerd, gVisor.\n\nThe pattern emerging here: AI-assisted security research is no longer finding bugs in CTF challenges. It is finding critical flaws in production cloud infrastructure. That changes the speed math for the entire industry — and for every developer who has ever assumed that a heavily audited service is a safe one.\n\n## What to Take From This\n\nFor most Cosmos DB users, there is nothing to do. Microsoft’s fix is complete. But the architectural lessons are worth internalizing — not just for Azure teams, but for anyone building multi-tenant infrastructure:\n\n**Sandbox restrictions must cover all execution primitives.** Blocking specific operations while leaving reflection open is not sandboxing — it is an obstacle course with a gap in the fence.**Platform-wide shared credentials amplify blast radius.** One key that retrieves primary keys for every customer account is a single point of catastrophic failure. Scope credentials to the narrowest possible surface.**Network isolation does not substitute for per-layer trust.** If a shared gateway above the isolation boundary holds cross-tenant credentials, “network-isolated” is a marketing label, not a security guarantee.\n\nThe Wiz team will walk through the full exploitation chain at Black Hat USA today. Full technical details are in the [Wiz Research CosmosEscape writeup](https://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db).", "url": "https://wpnews.pro/news/cosmosescape-azure-cosmos-dbs-gremlin-sandbox-escape", "canonical_source": "https://byteiota.com/cosmosescape-azure-cosmos-db-gremlin-sandbox-escape/", "published_at": "2026-08-01 15:15:31+00:00", "updated_at": "2026-08-01 15:23:48.117219+00:00", "lang": "en", "topics": ["ai-infrastructure", "ai-safety"], "entities": ["Wiz Research", "Microsoft", "Azure Cosmos DB", "Microsoft Entra ID", "Teams", "Copilot", "Black Hat USA", "Orca Security"], "alternates": {"html": "https://wpnews.pro/news/cosmosescape-azure-cosmos-dbs-gremlin-sandbox-escape", "markdown": "https://wpnews.pro/news/cosmosescape-azure-cosmos-dbs-gremlin-sandbox-escape.md", "text": "https://wpnews.pro/news/cosmosescape-azure-cosmos-dbs-gremlin-sandbox-escape.txt", "jsonld": "https://wpnews.pro/news/cosmosescape-azure-cosmos-dbs-gremlin-sandbox-escape.jsonld"}}