Introduction

The recent discovery of a critical vulnerability within Azure Cosmos DB, codenamed CosmosEscape, has sent ripples across the cloud computing community. Uncovered by Wiz Research, this flaw demonstrated the risks inherent in multi-tenant cloud environments, where shared infrastructure exposes all customers to potential breaches. In this post, we delve into the technical specifics of CosmosEscape, illustrating how a sandbox escape allowed unprecedented access to databases across tenants, and the lessons it imparts for cloud security.

Cosmos DB Architecture: The Shared Infrastructure Model

Azure Cosmos DB operates as a multi-tenant cloud service, hosting thousands of customers on shared infrastructure. Each tenant's data is isolated through access controls, encryption, and network segmentation. However, the CosmosEscape vulnerability highlighted a crucial weakness: a flaw in Microsoft's shared infrastructure can expose all tenants, regardless of customer-specific configurations.

Gremlin API: A Security Overview

The Gremlin API within Cosmos DB functions as a graph traversal language, supporting customers building complex graph databases. Gremlin queries translate into .NET code executed in a supposedly secure sandbox environment to remain isolated from broader system resources.

The Sandbox Escape: Defeating Isolation with .NET Reflection

The heart of the CosmosEscape vulnerability rests in the exploitation of .NET reflection capabilities. While Gremlin queries should only execute read-only graph operations, the sandbox failed to restrict .NET reflection APIs, allowing attackers to execute arbitrary code.

Using reflection, attackers could call system-level methods, breaking out of the sandbox to achieve code execution on the database gateway. This capability exposed the platform-wide 'Cosmos Master Key,' used to authenticate requests across all APIs.

Exploitation: From Sandbox Escape to Full Database Access

With code execution on the DB Gateway, attackers could access the 'Cosmos Master Key.' This key allowed them to:

  • Enumerate databases by subscription and tenant ID.
  • Retrieve primary keys for any Cosmos DB account.
  • Extract full read/write access to targeted databases.

Wiz's PoC illustrated how an attacker, with minimal prerequisites, could initiate an attack via a crafted Gremlin query from their own account and subsequently access any customer's database.

Wiz's AI-Powered Discovery

Wiz utilized their Atlas AI tool to identify and exploit CosmosEscape, making it the first notable cloud vulnerability discovered via an AI system. Atlas dissected the architecture, identified the Gremlin execution engine as a weak spot, and methodically developed the exploit chain, confirming AI's potential in pioneering vulnerability research.

Microsoft's Swift Response

Upon receiving the vulnerability report in November 2025, Microsoft rapidly deployed a hotfix to block the vulnerable entry point, rolling out a comprehensive fix by July 2026. They eliminated platform-wide keys, reinforcing the security architecture and concluding with transparent public disclosure.

Key Lessons and Takeaways

Shared Infrastructure Risks

CosmosEscape underscores a critical architectural lesson: shared infrastructure vulnerabilities necessitate vendor remediation. Customers cannot mitigate these risks through configuration alone. As such, continuous vendor-led security assessments are vital.

Continuous Security Testing

Infrastructure security requires relentless testing. Customer awareness of shared risks and vendor transparency ensures resilience against potential breaches.

Conclusion

CosmosEscape serves as a critical reminder of the complexities of multi-tenant cloud environments. Though vulnerabilities are inevitable, proactive research and responsive patching are paramount in maintaining security integrity. Microsoft's transparency and Wiz's innovative research underline the evolving nature of cloud security, illustrating how collaboration and innovation can preemptively address future challenges.