--- title: Critical Azure Cosmos DB flaw threatened cross-tenant... description: A critical vulnerability chain dubbed CosmosEscape in Azure Cosmos DB's Gremlin API allowed Wiz researchers to escape the query sandbox via .NET reflection... canonical: https://daily.dev/posts/critical-azure-cosmos-db-flaw-threatened-cross-tenant-database-takeover-l8fqwd6ly twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Azure Cosmos DB flaw threatened cross-tenant database takeover | daily.dev og:description: A critical vulnerability chain dubbed CosmosEscape in Azure Cosmos DB's Gremlin API allowed Wiz researchers to escape the query sandbox via .NET reflection... og:url: https://daily.dev/posts/critical-azure-cosmos-db-flaw-threatened-cross-tenant-database-takeover-l8fqwd6ly og:image: https://api.daily.dev/og/posts/L8fqWd6ly.png og:image:alt: Critical Azure Cosmos DB flaw threatened cross-tenant database takeover og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Azure Cosmos DB flaw threatened cross-tenant database takeover **[CSO Online](https://daily.dev/sources/csoonline)** · 5 min read · 0 upvotes · 0 comments ## Summary A critical vulnerability chain dubbed CosmosEscape in Azure Cosmos DB's Gremlin API allowed Wiz researchers to escape the query sandbox via .NET reflection abuse, execute arbitrary code on the Database Gateway, and obtain a platform-wide 'Cosmos Master Key' capable of accessing any customer's Cosmos DB account across all tenants, regions, and API types. Microsoft services including Entra ID, Teams, and Copilot were also potentially exposed. Disclosed privately in November 2025, Microsoft patched the attack path within 48 hours and completed a full architectural redesign by July 2026, eliminating the master key mechanism. No evidence of exploitation was found. Security experts recommend enterprises scrutinize provider-level tenant isolation, adopt managed identities over static keys, and review logs if they used the Gremlin API. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CosmosEscape: Taking over Every Database in Azure Cosmos DB](https://daily.dev/posts/cosmosescape-taking-over-every-database-in-azure-cosmos-db-7zp4vevni) · Hacker News · 0 upvotes · 0 comments - [Microsoft warns of max severity Entra ID flaw exploited in attacks](https://daily.dev/posts/microsoft-warns-of-max-severity-entra-id-flaw-exploited-in-attacks-trnyz1ea4) · BleepingComputer · 5 upvotes · 0 comments - [No single pane of glass: Anatomy of an Azure permission takeover](https://daily.dev/posts/no-single-pane-of-glass-anatomy-of-an-azure-permission-takeover-q7x1g2hf6) · Sysdig Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#azure-cosmos-db](https://daily.dev/tags/azure-cosmos-db) [View this post on daily.dev](https://daily.dev/posts/critical-azure-cosmos-db-flaw-threatened-cross-tenant-database-takeover-l8fqwd6ly) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Azure Cosmos DB flaw threatened cross-tenant database takeover","url":"https://daily.dev/posts/critical-azure-cosmos-db-flaw-threatened-cross-tenant-database-takeover-l8fqwd6ly","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-azure-cosmos-db-flaw-threatened-cross-tenant-database-takeover-l8fqwd6ly"},"datePublished":"2026-08-04T12:14:58.381Z","dateModified":"2026-08-06T09:49:18.487Z","description":"A critical vulnerability chain dubbed CosmosEscape in Azure Cosmos DB's Gremlin API allowed Wiz researchers to escape the query sandbox via .NET reflection...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/249c2fe5a225d09ac8814f649fe0cc12?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/249c2fe5a225d09ac8814f649fe0cc12?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-azure-cosmos-db-flaw-threatened-cross-tenant-database-takeover-l8fqwd6ly","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,azure-cosmos-db","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Critical Azure Cosmos DB flaw threatened cross-tenant database takeover"}]} ```