{"id":"INC-hashicorp-01M25QV97NFJ5AS3NQFCFRC98S","kind":"incident","aliases":[],"related":[],"title":"HashiCorp: Hashicorp Linux packages GPG key rotation","description":"Our Engineering team has resolved the issue. These systems should now be operating normally. If you continue to experience any problems, please open a ticket with our support team.","summary":"HashiCorp had an incident involving its Linux package repository GPG signing key rotation, and the vendor reports it is resolved. The source text does not say what broke or what an attacker could have done with it.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"HashiCorp","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["hashicorp","incident","linux","security","terraform","vault","vendor"],"not_affected_if":["not-using-hashicorp-linux-repo"],"how_to_check":"Check the incident page at https://status.hashicorp.com/incidents/01M25QV97NFJ5AS3NQFCFRC98S for the affected detail.","fix":"Re-import the current HashiCorp GPG key from the official install docs and confirm apt or yum package signature checks pass. unknown","status":"resolved","published_at":"2026-09-10T13:24:22+00:00","first_seen_at":"2026-10-23T19:12:22+00:00","triaged_at":"2026-10-23T21:50:52+00:00","updated_at":"2026-10-23T21:50:52+00:00","category":"vendor","confidence":0.35,"triage":{"at":"2026-10-23T21:50:52Z","model":"claude-haiku-5-5","output":{"fix":"Re-import the current HashiCorp GPG key from the official install docs and confirm apt or yum package signature checks pass. unknown","reach":"unknown","impact":"medium","summary":"HashiCorp had an incident involving its Linux package repository GPG signing key rotation, and the vendor reports it is resolved. The source text does not say what broke or what an attacker could have done with it.","category":"vendor","who_cares":["hashicorp","terraform","vault","linux"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; source does not describe attacker capability","analyst_note":"Read the status page incident timeline to learn whether signing keys were misissued or only the repo was unavailable, and whether any packages were affected.","how_to_check":"Check the incident page at https://status.hashicorp.com/incidents/01M25QV97NFJ5AS3NQFCFRC98S for the affected detail.\nunknown","needs_analyst":true,"not_affected_if":["not-using-hashicorp-linux-repo"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000477,"input_tokens":2781,"output_tokens":398,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'01m25qv97nfj5as3nqfcfrc98s':11A 'attack':51B 'broke':47B 'continu':71C 'could':52B 'done':54B 'engin':56C 'experi':73C 'gpg':5A,29B 'hashicorp':1A,2A,10A,12A,13B,20B 'inc':9A 'inc-hashicorp-01m25qv97nfj5as3nqfcfrc98s':8A 'incid':14B,23B 'involv':24B 'issu':61C 'key':6A,31B 'linux':3A,15B,26B 'normal':68C 'open':77C 'oper':67C 'packag':4A,27B 'pleas':76C 'problem':75C 'report':36B 'repositori':28B 'resolv':39B,59C 'rotat':7A,32B 'say':45B 'secur':16B 'sign':30B 'sourc':41B 'support':82C 'system':63C 'team':57C,83C 'terraform':17B 'text':42B 'ticket':79C 'vault':18B 'vendor':19B,35B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-10T13:24:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"hashicorp:01M25QV97NFJ5AS3NQFCFRC98S","url":"https://status.hashicorp.com/incidents/01M25QV97NFJ5AS3NQFCFRC98S","severity":"high","published_at":"2026-09-10T13:24:22+00:00","modified_at":"2026-09-10T20:40:53+00:00","first_seen_at":"2026-10-23T19:12:22+00:00","fetched_at":"2026-10-26T09:06:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}