NORTHFLANK · Vendor
NO FIX YET · SEE WHAT TO DO
Northflank, a hosted deployment platform, disclosed an attack in which an intruder decrypted secrets held in its control plane between 30 October and early November. The company says running workloads and workload data were not accessed, but some customers reported unauthorised use of AI provider keys.
first public Oct 30, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that store secrets such as API keys, cloud credentials or database passwords in Northflank integrations or project secrets on the shared control plane. Customers on forward-deployed or dedicated control planes are stated to be unaffected, and workloads themselves are stated to have not been accessed.
Not affected if dedicated-control-plane, forward-deployed-control-plane
Who cares ai-providers, byoc, cloud-credentials, northflank, security, self-hosted
Type: Incident
Affected Components: Builds, Networking, Addons, Logs and Metrics, Jobs, Services, Certificates
Nov 6, 10:09:38 GMT+0 - Monitoring - The platform has remained operational and customer workloads have remained online throughout the incident. At this time, we have found no evidence that customer workloads or workload data were accessed.
The first known decryption of secrets occurred between 02:39 UTC and 03:08 UTC on 30 October. Northflank received its first security platform alert at 11:43 UTC, and our engineers responded within minutes. The exploit was patched within 60 minutes of notification, and customers were notified within two hours.
Intermittent platform degradation occurred during a high volume of simultaneous customer redeployments and during our subsequent key rotation and platform hardening work.
We have worked with upstream providers to revoke credentials where possible.
For users
Please rotate all integration and project secrets if you have not already done so, review provider logs for unusual activity, and enable IP restrictions and budget limits wherever available.
For upstream providers
We strongly recommend providing API endpoints for credential revocation, IP restrictions, and enforceable budget limits. These controls enable faster incident response and help limit the impact of compromised credentials.
Our investigation and independent forensic review remain ongoing. We will share further confirmed findings and a root cause analysis once available. Nov 2, 11:09:51 GMT+0 - Monitoring - We believe the attack vector was contained within an hour of the first alert. Our investigation shows no sign that the attacker was in our environment after the attack.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Independent forensic auditors began reviewing the attack together with Northflank over the weekend, and they continue to review it.
Impact on your workloads
Running workloads were unaffected. At this time we have seen no sign that workloads or workload data were accessed during the attack. Evidence suggests it was focused on secrets held in our control plane. Customers on forward-deployed or dedicated control planes are unaffected.
Separately, we have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration. If your BYOC cluster is no longer connected to Northflank, please contact support.
Over the last few days there has been intermittent platform degradation while we rotated our own keys and hardened the platform.
What you need to do
Some customers have reported unauthorised use of AI secrets. Please rotate all secrets now, both integration secrets and project secrets, even if you haven’t seen suspicious activity. We recommend starting with AI provider keys, cloud provider credentials, payment provider keys, private keys, and database and other service credentials.
We also recommend reviewing your provider logs for unusual activity. If you have seen unexpected AI usage or spend, contact your AI providers directly, such as OpenAI and Anthropic.
Where we were able to act on your behalf, we have revoked Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts. If you haven’t already, sign in again and reconnect your integrations.
Need help?
If you need help rotating secrets or checking that everything has been rotated, contact support@northflank.com, or use your direct channel with us if you have one. We are treating this with the utmost urgency, and the entire organisation has been working 24/7.
What’s next
We will keep updating this page as the review progresses, and we intend to share a root cause analysis once we have confirmed findings. Oct 31, 23:31:08 GMT+0 - Identified - Secret rotation is now available for RabbitMQ add-ons for all customers.
Please rotate all secrets if you have not already. Oct 31, 22:32:19 GMT+0 - Identif