🕵️ RESEARCH & DEEP DIVES
- 16-Year-Old Researcher Finds Microsoft Titan Auth Flaw Exposing 17.3 Trillion Records
A 16-year-old researcher found a JWT authentication flaw in Microsoft's internal Titan analytics service that allowed forged admin access to an estimated 17.3 trillion database rows.- Applies to Microsoft's internal Titan analytics service, hosted via Azure Cloud Services, with a public API exposing a /v2/Query route that accepted raw SQL.
- Titan validated JWT claims (tenant ID, audience, app ID, user identity) but never cryptographically verified the token signature, accepting an 'alg: none' token with an empty signature.
- Setting the token's upn claim to 'admin' mapped to local user ID 1 with the Admin role, enabling unauthorized SQL queries; metadata exposed included ~25,000 account records, 17,990 employee emails, 355 database configs, and 24,569 dashboards.
- Testing 56 archived routing values found 30 active routes resolving to 17 ClickHouse databases with 9,863 tables, yielding an estimated 17,333,335,124,315 rows — likely including historical and duplicated records, not unique individuals.
- Reported to MSRC on September 5, 2026 (case 144051); Microsoft locked down the endpoint on September 9 and paid a $5,000 bounty; no evidence of malicious exploitation or customer PII access.
Sources 📄 Source: blog.faav.net · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-100597 — OpenClaw — CVSS 8.8 — OpenClaw before 2026.7.1 Path Traversal via Filesystem RaceOpenClaw (npm pack...
CVE-2026-100599 — OpenClaw — CVSS 8.7 — OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome...
CVE-2026-100596 — OpenClaw — CVSS 8.7 — OpenClaw before 2026.7.1 Authorization Bypass via MCP ConfigurationOpenClaw v...
CVE-2026-100589 — OpenClaw — CVSS 8.7 — OpenClaw before 2026.7.1 Sandbox Bypass via Browser NodeOpenClaw versions bef...
CVE-2026-100588 — OpenClaw — CVSS 8.7 — OpenClaw before 2026.7.1 Authentication Bypass via node.invokeOpenClaw (npm p...
CVE-2026-100587 — OpenClaw — CVSS 8.7 — OpenClaw before 2026.7.1 Authorization Bypass via Codex InstallOpenClaw versi...
CVE-2026-100586 — OpenClaw — CVSS 8.7 — OpenClaw Codex before 2026.7.1 Authorization Bypass via BindOpenClaw Codex be...
CVE-2026-100585 — OpenClaw — CVSS 8.6 — OpenClaw before 2026.7.1 Authentication Bypass via MCP ChannelOpenClaw (npm p...
CVE-2026-100598 — OpenClaw — CVSS 7.5 — OpenClaw before 2026.7.1 Approval Binding Logic ErrorOpenClaw (npm package op...
CVE-2026-100594 — OpenClaw — CVSS 7.1 — OpenClaw before 2026.7.1 Authorization Bypass via trajectory exportOpenClaw v...
CVE-2026-100582 — openclaw msteams — CVSS 7.1 — OpenClaw msteams before 2026.8.1 Channel Read Allowlist BypassOpenClaw channe...
CVE-2026-100581 — OpenClaw — CVSS 6.8 — OpenClaw iOS before 2026.8.11 Credential Storage via Share ExtensionOpenClaw ...