Microsoft's Titan skipped the token signature check: 17.3 trillion rows counted, two sampled

17.3 trillion rows counted, two rows sampled

The number in the headlines is 17,333,335,124,315. It comes from the researcher's own write-up, where Faav, who is 16, says an AI assistant summed table row counts taken from the metadata of 17 ClickHouse databases, and that the total "likely includes historical, duplicated, and derived data". The same write-up describes reading two rows of analytics data, both of them one-row samples from a Bing analytics dataset. That is 2 of 17,333,335,124,315, about one in 8.7 trillion (our arithmetic).

The ratio is not a criticism of the research. The write-up's own title says the records could have been accessed, and it says nothing was dumped and that the report went in the same day. It is the shape of the claim: 17.3 trillion measures what a missing signature check put within reach, not what anyone read. The Register's headline says the researcher "got admin access to databases with 17.3 trillion rows"; its opening paragraph says only that the flaw could "potentially reach" them.

What the ratio does not establish is most of what the headline invites. No source says that any customer's data was in scope, that anyone but the researcher used the flaw, what the fix was, or how long the flaw existed. The admin was a local account inside Titan, Microsoft's internal analytics service; the write-up describes no Azure, Entra or Microsoft 365 privilege. Everything known rests on one account, the researcher's, which says Microsoft had editorial control over it.

What the record states, and what it does not

What the researcher's write-up (25 September 2026), The Register and iTnews state, and what they leave open. Read 30 September 2026.

Question	Stated	Not stated
What was admin?	The string admin matched local user ID 1, which held Titan's Admin role.	Whether it could change data; any Azure, Entra or Microsoft 365 privilege.
What was read?	Titan metadata, two one-row Bing samples, test queries, row counts from 17 databases.	What Microsoft cut from the post; any other query.
Whose data?	Researcher: no customer data or PII. The post also describes employee records and a Bing record with identifiers.	Whether any of the 9,863 tables hold customer content.
Anyone else?	Microsoft asked for the researcher's IP address to confirm no other activity.	The answer; whether others were looked for; how long the flaw existed.
What was the fix?	Endpoint locked down on 9 September.	Whether signatures are now checked or the endpoint was closed off.
CVE or advisory?	None in any source; none naming Titan in Microsoft's August or September 2026 feeds.	Whether Microsoft rates it critical.
What must customers do?	Microsoft's statement asks for nothing.	Whether Microsoft has told any customer anything.

The Register prints Microsoft's statement as one provided to the researcher for the blog post; iTnews reports none of its own. It says the disclosure helped protect customers by hardening services, and does not say whether customer data was in scope.

Two defects, one door

The front door and the side door. Per the write-up, Titan's web interface showed non-employees a notice that a VPN was required. The API was a different door: a separate hostname on an Azure Cloud Services host, found by the researcher's AI tool, Antares, searching Microsoft subdomains. Its public interface file listed four routes, and the one that took raw SQL answered 401 without a token. Archived 2023 snapshots of the web interface supplied 56 routing values. The discovery steps used only public information: a subdomain search, a public interface file and archived web pages.

Defect one: checks that all looked at claims. Over about ten days the tool, which the write-up says ran Codex and Claude, worked through the errors one at a time: tenant, audience, application allowlist, then a user lookup. Edited claims were accepted with the signature left as it was, and a token with no signature was accepted too. A service that checks who a token says it is, who it is for and which application sent it, but not whether the issuer signed it, has checked everything an attacker can write.

Defect two: a claim used as a local name. The lookup read the upn claim, normally an email style Entra identity, as a local username. Email style names were not found; the plain string admin matched user ID 1, which held the Admin role. The researcher infers this from behaviour; no code is described. The AI tool missed it because the field was called upn, and it kept trying email shaped names.

Both missing controls are in Microsoft's own guidance. Microsoft Learn says web APIs must validate the access tokens sent to them, signature and issuer first. Its claims guidance says not to authorise on upn, which changes over a user's life, and to key on the immutable tenant ID and object ID.

Four days to a lockdown, twenty to a write-up

The dates are the researcher's; the gaps are our arithmetic. Antares surfaced Titan's API on 25 August. Admin access came after 1 AM on Saturday 5 September and a report to Microsoft Security Response Center (MSRC), case 144051, was opened the same day. MSRC asked for testing to stop between 6 and 8 September. The endpoint was locked down on 9 September, 4 days after the report. The bounty followed on 17 September. After a meeting and a rework of the write-up at Microsoft's request, it was published on 25 September, 20 days after the report. The write-up says ten days of testing; the calendar gives 11.

What the dates do not establish. Four days is report to lockdown, not report to fix: no source says what locked down meant. The request for the researcher's IP address suggests Microsoft could check its own logs (our inference). The period before 25 August is unknown: a 2023 snapshot dates the web interface, not the flaw.

No CVE as of this evening. In June 2024 Microsoft said it would issue CVEs for critical cloud service vulnerabilities even when customers need take no action. Its August and September 2026 Security Update Guide feeds, 1,674 and 2,600 entries, contain none naming Titan. That does not show the flaw was rated below critical, and a record can still follow. Today the only description of the flaw is the researcher's edited post.

The $5,000. No source says which programme paid it or how the report was rated. For scale only, Microsoft's Azure bounty page lists awards from $1,250 to $60,000; nothing says Titan fell under it.

Five labels that did the work

The friendly-name fallacy, in five labels. Each is true of something, and none is a control.

upn. A field named for an Entra identity, used as a local username, which Microsoft's guidance says not to authorise on. By the write-up, it kept the AI tool testing email shaped values for ten days.

admin. A username, not a privilege boundary. The interface file listed an insert route as well as a query route; the write-up describes no attempt to write and does not say whether writing was possible.

17.3 trillion rows. A sum of metadata counts, one replica per shard. A row is a storage unit; it says nothing about how many people, tenants or customers the rows describe.

Locked down. Every account says it; none says how. If it was network restriction, the signature check may still be missing behind it (our inference). Microsoft's own phrase, hardening its services, is as unspecific.

No customer data or PII. That statement sits beside the same post's employee email and organisation records, a user record with names and login history, and a Bing record with a search, identifiers and country or state location. The post does not define customer. The people behind Bing searches are not obviously customers in a commercial sense, but they are people (our reading).

Method, interest and disclosure

The account is a researcher's, edited by the company it is about: the write-up says Microsoft had editorial control and cut sections and figures, and iTnews reports the same. A researcher gains from the scale of what was reachable, a vendor from a modest account of impact. The post's own hedges, hypothetical, estimated and could have, are the best guide to what it claims, and they are more careful than the headline that followed. The figures cannot be checked from outside. The AI agent did ten days of enumeration and a human made the last step: assume that persistence is cheap.

Earlier briefings are close kin. In Cloudflare's cross tenant postmortem every container had its own microVM and the boundary that failed was one option on a disk pool; here it is one missing check on a token. A KEV entry that named the wrong flaw concerned a JSON Web Token signature bypass recorded as CWE-347; Titan has no CWE, and by description it is the same family (our inference).

What to do, in the order worth doing

What Microsoft says customers must do: nothing is stated. Its statement asks for no customer action, and we found no advisory, CVE or customer notice as of the evening of 30 September 2026. Titan is described as internal, so there may be nothing to patch; what is open is whether any customer's data was in it.

Items 3 to 5 follow RFC 8725 and Microsoft Learn; item 8 follows the ICO's guide. The rest are our own practice, not findings of the write-up.

The question that exposes the gap

A service that does not verify signatures cannot tell its authentication records from a forgery, so the only evidence of who else used it is the query log, if one was kept. The write-up says what the researcher did; Microsoft's statement says nothing about anyone else. For the period the flaw existed, what record exists of the queries that ran, how far back does it go, and who has read it?

Key facts