Executive Summary
Publication Date: September 2026
A critical vulnerability was discovered in the internal Microsoft Titan Analytics service, as detailed in the article "How I Could've Accessed 17 Trillion Microsoft Records" published on blog.faav.net in September 2026. The flaw, uncovered by a 16-year-old security researcher known as Faav, exposed a fundamental weakness in the authentication mechanism of a Microsoft internal analytics platform. This vulnerability could have allowed an attacker to forge administrator-level access and execute arbitrary SQL queries, potentially exposing over 17 trillion records. The issue was responsibly disclosed to Microsoft, which promptly remediated the flaw. There is no evidence of malicious exploitation prior to the disclosure.
Technical Information
The vulnerability centered on the Microsoft Titan Analytics service, an internal analytics platform hosted on Azure Cloud Services. The service exposed a public API endpoint, which was documented via an accessible Swagger interface. This API included several routes, most notably /v2/Query, which accepted raw SQL queries.
The authentication mechanism relied on JSON Web Tokens (JWTs). However, the backend implementation failed to cryptographically verify the JWT signature. Instead, it only checked the claims within the token, such as tenant ID, audience, application ID, and user identity. Critically, the service accepted tokens with the alg: none header and an empty signature, a well-known anti-pattern that effectively disables signature verification.
By crafting a JWT with alg: none and setting the upn (User Principal Name) claim to admin, an attacker could impersonate the administrator account. The backend mapped this claim to the local user ID 1, which is typically reserved for administrative privileges. This allowed the attacker to gain full administrative access to the Titan Analytics backend and execute arbitrary SQL queries against the underlying ClickHouse databases.
The exposed data included metadata for approximately 25,000 accounts and emails, 17,990 employee emails, 15,001 organization records, 355 database configurations, 20,979 virtual-dataset SQL definitions, 24,569 dashboards, 425,891 charts, and 27,347 dataset definitions. The total estimated exposure was over 17.3 trillion rows across 17 ClickHouse analytics databases, comprising 9,863 unique tables and 30 active API routes.
The vulnerability was discovered on August 25, 2026, by Faav using an AI-powered hacking assistant named Antares. The issue was reported to the Microsoft Security Response Center (MSRC) on September 5, 2026, under case number 144051. Microsoft responded rapidly, locking down the vulnerable API endpoint by September 9, 2026, and awarding a $5,000 bug bounty to the researcher on September 17, 2026.
No personally identifiable information (PII) or customer data was accessed during the research, and only metadata and limited samples were reviewed to confirm the extent of the exposure. There is no evidence that the vulnerability was exploited in the wild prior to its disclosure and remediation.
From a technical perspective, this incident highlights the critical importance of proper JWT signature verification. Accepting unsigned tokens (alg: none) is a severe security misconfiguration that has been documented in previous high-profile breaches. The flaw mapped closely to several MITRE ATT&CK techniques, including T1078 (Valid Accounts), T1552 (Unsecured Credentials), T1190 (Exploit Public-Facing Application), and T1606 (Forge Web Credentials).
The affected product was the internal Microsoft Titan Analytics service, specifically all builds and deployments up to September 9, 2026. The vulnerability was not present in any commercial or customer-facing Microsoft products, and the affected API endpoints were internal to the organization.
Indicators of compromise for this vulnerability would include abnormal access to the /v2/Query route from non-internal IP addresses and the acceptance of JWTs with alg: none and empty signatures by the backend. While there is no evidence of exploitation by advanced persistent threat (APT) groups or criminal actors in this specific case, similar JWT signature bypasses have been leveraged in other cloud service attacks by groups such as APT29.
The incident underscores the necessity for organizations to enforce strict cryptographic verification of all authentication tokens, reject unsigned tokens, and restrict accepted algorithms to secure defaults. It also demonstrates the value of responsible disclosure and rapid vendor response in mitigating potential large-scale data exposures.
References
Original Article - blog.faav.net
Rescana is here for you
At Rescana, we are committed to helping organizations identify, assess, and mitigate third-party and supply chain cyber risks. Our advanced TPRM platform provides continuous monitoring, automated risk analysis, and actionable intelligence to safeguard your digital ecosystem. If you have any questions about this report or would like to learn more about how Rescana can help protect your organization, we are happy to answer your questions at info@rescana.com.
