# CosmosEscape: Azure Cosmos DB’s Gremlin Sandbox Escape > Source: > Published: 2026-08-01 15:15:31+00:00 On July 30, Wiz Research disclosed CosmosEscape: a chained vulnerability in Azure Cosmos DB’s Gremlin API where a researcher could craft a query against their own database and walk away with a key to everyone else’s. The blast radius included Microsoft Entra ID, Teams, and Copilot. A hotfix landed 48 hours after Wiz reported it in November 2025. The full architectural fix — eliminating the shared signing key that made this catastrophic — wrapped up last month. The full exploitation chain [goes public today at Black Hat USA](https://www.securityweek.com/critical-flaw-led-to-azure-cosmos-db-pwnage/). ## How the Attack Worked Azure Cosmos DB’s Gremlin engine compiles graph queries into .NET code and runs them inside a sandboxed environment. The sandbox blocked specific Gremlin operations — but it did not restrict .NET reflection. That distinction matters: reflection is a runtime capability that lets code dynamically invoke arbitrary types and methods, bypassing the type-system checks the sandbox was built around. Wiz researchers used reflection to build file-read and file-write primitives, then escalated to arbitrary code execution on the DB Gateway — the shared, multi-tenant Service Fabric clusters that process customer queries. The proof of concept was blunt: they ran `hostname` on Cosmos DB’s backend infrastructure, through queries submitted to their own database, without touching any other customer’s account. The sandbox was already gone at that point. ## The Key That Unlocked Everything Once inside the Gateway, the researchers found what they named the Cosmos Master Key: a platform-wide signing credential that could retrieve the primary key for any Cosmos DB account on the service — across all tenants, all regions, and all API flavors (SQL, MongoDB, Cassandra, Gremlin) — through publicly accessible endpoints. Primary keys grant full read, write, and delete control over everything in an account. The Gateway also had access to a Config Store: a queryable directory containing every Cosmos DB account name, subscription ID, tenant ID, and network configuration. One region’s index alone held thousands of Microsoft-internal databases. An attacker with the Master Key and the Config Store could enumerate targets by organization, filter by region, and retrieve primary keys for precision-targeted attacks — all from a standard Azure account they controlled. ## The Blast Radius Customer databases were the obvious target. Less obvious: the attack path reached Microsoft’s own infrastructure. Entra ID, Teams, and Copilot all use Cosmos DB on the backend. Network isolation did not help — isolation policies are enforced at the account layer; this attack ran through the Gateway layer above it. Private and network-isolated accounts were just as reachable as public ones. Microsoft confirmed no evidence of exploitation before the November 2025 disclosure, and no customer action is required. The [patching was entirely server-side](https://thehackernews.com/2026/07/azure-cosmos-db-flaw-exposed-platform.html). ## The Third Time CosmosEscape is the third critical sandbox escape from Azure Cosmos DB in five years: **ChaosDB (2021):** Wiz exploited a Server-Side Request Forgery flaw in Cosmos DB’s Jupyter Notebook feature — enabled by default — to access cross-tenant databases.[Microsoft patched in 48 hours.](https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough)**CosMiss (2022):** Orca Security found unauthenticated remote code execution in Cosmos DB Notebooks. Patched in two days.**CosmosEscape (2025):** Wiz found .NET reflection in the Gremlin engine escapes the sandbox and reaches a platform-wide signing key. Microsoft hotfixed in 48 hours, completed architectural overhaul in July 2026. Different entry points, same pattern: a sandbox that did not account for all execution primitives, sitting adjacent to shared credentials. “No customer action required” was true each time — but framing that as a clean outcome ignores the structural issue. Three escapes from the same service suggests the sandbox architecture needed a fundamental rethink, not incremental patching. The July 2026 overhaul — eliminating the platform-wide key — looks like Microsoft finally agreeing. ## An AI Found This Three days before the CosmosEscape disclosure, Wiz publicly launched [Atlas](https://www.wiz.io/blog/atlas-ai-vulnerability-researcher): their autonomous AI vulnerability research system. CosmosEscape is the first publicly confirmed critical cloud infrastructure vulnerability where Atlas assisted in discovery. Atlas is not a single model. It runs as a multi-agent pipeline: threat modeling, parallel hypothesis testing, adversarial validation between competing agents, and dynamic proof executed in an isolated environment. It ranked first on the CyberGym benchmark with a 90.9% success rate. It has found more than 200 previously unknown vulnerabilities in some of the most-audited codebases on the planet — Linux kernel, Kubernetes, gRPC, containerd, gVisor. The pattern emerging here: AI-assisted security research is no longer finding bugs in CTF challenges. It is finding critical flaws in production cloud infrastructure. That changes the speed math for the entire industry — and for every developer who has ever assumed that a heavily audited service is a safe one. ## What to Take From This For most Cosmos DB users, there is nothing to do. Microsoft’s fix is complete. But the architectural lessons are worth internalizing — not just for Azure teams, but for anyone building multi-tenant infrastructure: **Sandbox restrictions must cover all execution primitives.** Blocking specific operations while leaving reflection open is not sandboxing — it is an obstacle course with a gap in the fence.**Platform-wide shared credentials amplify blast radius.** One key that retrieves primary keys for every customer account is a single point of catastrophic failure. Scope credentials to the narrowest possible surface.**Network isolation does not substitute for per-layer trust.** If a shared gateway above the isolation boundary holds cross-tenant credentials, “network-isolated” is a marketing label, not a security guarantee. The Wiz team will walk through the full exploitation chain at Black Hat USA today. Full technical details are in the [Wiz Research CosmosEscape writeup](https://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db).