Wiz Discloses CosmosEscape: Azure Cosmos DB Gremlin Sandbox Escape Yielded Platform-Wide Master Key Enabling Full Cross-Tenant DB Takeover

Wiz Research disclosed CosmosEscape, an exploit chain beginning with a crafted Gremlin API query that escaped the sandbox, gained code execution on a multi-tenant gateway, and retrieved a platform-wide signing secret granting read/write access to every Cosmos DB account on the service — including internal Microsoft databases backing Entra ID, Teams, and Copilot. Microsoft patched the Gremlin entry point within 48 hours of the November 2025 report and completed a full architectural fix eliminating the Cosmos Master Key across all regions in July 2026. No CVE or CVSS score was assigned, and Microsoft states no unauthorized customer access occurred, but the duration of potential exposure prior to the hotfix remains unknown.

Microsoft patched the Gremlin entry point within 48 hours of the November 2025 report and completed a full architectural fix eliminating the Cosmos Master Key across all regions in July 2026.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.