CosmosEscape is a critical vulnerability in Azure Cosmos DB's Gremlin API that allowed sandbox escape and arbitrary code execution. The Cosmos DB Gremlin engine translated Gremlin graph queries into .NET code and enforced restrictions to prevent queries from escaping Gremlin operations. However, these restrictions failed to account for .NET reflection, enabling attackers to craft malicious Gremlin queries that achieved file read, file write, and arbitrary code execution on the DB Gateway backend. The DB Gateway runs on multi-tenant Azure Service Fabric clusters and executes customer queries on their behalf. By exploiting the sandbox escape, attackers gained access to credentials on the cluster, including a platform-wide signing key dubbed the 'Cosmos Master Key.' This key was not scoped to any single account — it worked across all tenants, regions, and API types (SQL, MongoDB, Cassandra, Gremlin) and could retrieve the primary key (granting full read/write access) for any Cosmos DB account on the service via publicly accessible endpoints. Additionally, the Cosmos Master Key unlocked access to the 'Config Store,' a regional Cosmos DB database serving as a directory of all Cosmos DB accounts, containing account names, subscription IDs, tenant IDs, network settings, and tags. Since the Config Store was itself a Cosmos DB database, it could be queried with full SQL flexibility. This enabled attackers to enumerate all accounts in a region or filter by tenant/subscription ID to target specific organizations. The attack chain: (1) Craft a malicious Gremlin query to escape the sandbox and execute arbitrary code on the DB Gateway, (2) Extract the Cosmos Master Key from cluster credentials, (3) Query the Config Store to enumerate or target specific Cosmos DB accounts, (4) Use the Cosmos Master Key to retrieve any account's primary key and gain full read/write access. The vulnerability also bypassed network isolation since the DB Gateway enforces network controls, and write access to the Config Store could allow overwriting network isolation settings. Microsoft internal services using Cosmos DB — including Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot — were also potentially exposed.