CosmosEscape: A Sandbox Bug in Azure Cosmos DB Exposed a Master Key to Every Customer Database
Wiz Research found a flaw chain in Cosmos DB's Gremlin engine that let a standard account escape its query sandbox and retrieve a platform-wide signing key. Microsoft fixed it months ago; no customer data was touched.
Wiz Research disclosed a vulnerability chain in Azure Cosmos DB, dubbed CosmosEscape, that let any standard account holder escape the query sandbox and pull a signing key with read/write access to every Cosmos DB account on the platform — across every region, every tenant, and every API flavor including SQL, MongoDB, Cassandra, and Gremlin.
The attack started in Cosmos DB’s Gremlin query engine. Attackers crafted Gremlin queries that abused .NET reflection to break out of the sandbox meant to restrict what a query can touch, achieving arbitrary code execution on the DB Gateway itself. From there, the exploit chain reached a single platform-wide signing key Wiz calls the “Cosmos Master Key” — a credential that worked across all regions and tenants — plus the Config Store, a regional registry holding account metadata, subscription IDs, tenant IDs, and network settings for every Cosmos DB deployment, including ones configured as network-isolated.
That combination is what makes CosmosEscape severe: a bug reachable from a standard, non-privileged account escalated into full read/write access to any customer’s database, regardless of how tightly that customer had locked down network access on their end. Wiz put it plainly: “A vulnerability at this layer can cascade upward and threaten the services built on top of it” — a direct reference to the fact that Microsoft Teams, Entra ID, and Copilot all depend on Cosmos DB underneath.
Wiz reported the issue to Microsoft on November 20, 2025. Microsoft shipped a hotfix blocking the vulnerable Gremlin entry point within 48 hours and then spent the following eight months building and rolling out the deeper architectural fix — eliminating the platform-wide key entirely — completing it across all regions in July 2026, ahead of the July 30 public disclosure. No CVE or CVSS score has been assigned to CosmosEscape.
Microsoft says the investigation found no evidence of customer impact: “We have fully addressed the issue and found no evidence of customer impact based on our investigations.” No unauthorized activity was detected outside Wiz’s own authorized testing, and Microsoft says no customer action is required — the fix was entirely server-side. Wiz is holding back full exploit details until a Black Hat USA briefing scheduled for August 6, 2026.
This is a coordinated-disclosure success story rather than an active-exploitation emergency, but the underlying lesson holds regardless: a single platform-wide credential is a catastrophic single point of failure in multi-tenant cloud infrastructure, and sandboxed query languages are only as safe as their weakest reflection boundary.