CosmosEscape: Azure Cosmos DB Gremlin Sandbox Escape Leading to Platform-Wide Key Exposure
First seen Jul 31, 2026 · Updated Jul 31, 2026
Security researchers at Wiz disclosed a now-patched vulnerability chain in Azure Cosmos DB, dubbed CosmosEscape, that allowed an attacker to escape the Gremlin query sandbox and obtain a platform-wide key granting full read/write access to databases across multiple customer tenants. The flaw originated from a crafted, attacker-controlled Gremlin query that achieved code execution on the underlying host, breaking multi-tenant isolation. Microsoft has remediated the issue; no evidence of in-the-wild exploitation was reported.
Technical Analysis
The CosmosEscape chain began with a maliciously crafted Gremlin graph query submitted to a Cosmos DB Gremlin API endpoint, which allowed the attacker to break out of the query execution sandbox and achieve code execution on the backend host. From this foothold, the attacker was able to escalate privileges and retrieve a platform-wide access key, effectively bypassing tenant isolation boundaries and gaining read/write access to databases belonging to other Azure customers. This represents a critical multi-tenant cloud isolation failure rather than a traditional client-side exploit, since a single compromised endpoint could cascade into cross-tenant compromise. No CVE has been publicly assigned as of the report; Microsoft patched the issue server-side, requiring no customer action. Organizations running AI agents, RAG pipelines, or LLM tool-use frameworks that store vector embeddings, conversation logs, or credentials in Cosmos DB (a common backend for Azure-based agent architectures such as Semantic Kernel or Azure AI Studio) could have faced exposure of sensitive agent data, API keys, and cross-tenant database access had this flaw been exploited before patching.
Affected Systems
Microsoft Azure Cosmos DB service, specifically instances exposing the Gremlin API (graph database query engine); affects the multi-tenant backend infrastructure rather than a specific customer-deployed software version
Indicators of Compromise
- No specific IOCs published; vulnerability was responsibly disclosed by Wiz and patched server-side by Microsoft prior to public disclosure
Remediation Steps
- 1
Confirm patch status
No customer action required as Microsoft has patched the vulnerability server-side; confirm via Azure service health notifications that your tenant is covered.
- 2
Rotate Cosmos DB keys
As a precaution, rotate primary and secondary Cosmos DB access keys and any connection strings used by applications or AI agent pipelines.
- 3
Audit Cosmos DB access logs
Review Azure Monitor and Cosmos DB diagnostic logs for anomalous Gremlin query patterns or unexpected cross-database access prior to the patch date.
- 4
Restrict Gremlin API exposure
Limit network access to Cosmos DB Gremlin endpoints using firewall rules, private endpoints, and role-based access control to reduce attack surface.
- 5
Review agent data stores
For AI agent or RAG deployments using Cosmos DB as a vector store or memory backend, verify no unauthorized access occurred and rotate any API keys or secrets stored within affected databases.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.