{"id":"INC-northflank-cmvv0rn5a092f14rutwccodpp","kind":"incident","aliases":[],"related":[],"title":"Northflank: Security incident","description":"Type: Incident\n    \n\n    Affected Components: Builds, Networking, Addons, Logs and Metrics, Jobs, Services, Certificates\n    Nov 6, 10:09:38 GMT+0 - Monitoring - The platform has remained operational and customer workloads have remained online throughout the incident. At this time, we have found no evidence that customer workloads or workload data were accessed.\n\nThe first known decryption of secrets occurred between 02:39 UTC and 03:08 UTC on 30 October. Northflank received its first security platform alert at 11:43 UTC, and our engineers responded within minutes. The exploit was patched within 60 minutes of notification, and customers were notified within two hours.\n\nIntermittent platform degradation occurred during a high volume of simultaneous customer redeployments and during our subsequent key rotation and platform hardening work.\n\nWe have worked with upstream providers to revoke credentials where possible.\n\n**For users**\n\nPlease rotate all integration and project secrets if you have not already done so, review provider logs for unusual activity, and enable IP restrictions and budget limits wherever available.\n\n**For upstream providers**\n\nWe strongly recommend providing API endpoints for credential revocation, IP restrictions, and enforceable budget limits. These controls enable faster incident response and help limit the impact of compromised credentials.\n\nOur investigation and independent forensic review remain ongoing. We will share further confirmed findings and a root cause analysis once available. Nov 2, 11:09:51 GMT+0 - Monitoring - We believe the attack vector was contained within an hour of the first alert. Our investigation shows no sign that the attacker was in our environment after the attack.  \n  \nIndependent forensic auditors began reviewing the attack together with Northflank over the weekend, and they continue to review it.  \n  \nImpact on your workloads  \n  \nRunning workloads were unaffected. At this time we have seen no sign that workloads or workload data were accessed during the attack. Evidence suggests it was focused on secrets held in our control plane. Customers on forward-deployed or dedicated control planes are unaffected.  \n  \nSeparately, we have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration. If your BYOC cluster is no longer connected to Northflank, please contact support.  \n  \nOver the last few days there has been intermittent platform degradation while we rotated our own keys and hardened the platform.  \n  \nWhat you need to do  \n  \nSome customers have reported unauthorised use of AI secrets. Please rotate all secrets now, both integration secrets and project secrets, even if you haven’t seen suspicious activity. We recommend starting with AI provider keys, cloud provider credentials, payment provider keys, private keys, and database and other service credentials.  \n  \nWe also recommend reviewing your provider logs for unusual activity. If you have seen unexpected AI usage or spend, contact your AI providers directly, such as OpenAI and Anthropic.  \n  \nWhere we were able to act on your behalf, we have revoked Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts. If you haven’t already, sign in again and reconnect your integrations.  \n  \nNeed help?  \n  \nIf you need help rotating secrets or checking that everything has been rotated, contact [support@northflank.com](mailto:support@northflank.com), or use your direct channel with us if you have one. We are treating this with the utmost urgency, and the entire organisation has been working 24/7.  \n  \nWhat’s next  \n  \nWe will keep updating this page as the review progresses, and we intend to share a root cause analysis once we have confirmed findings. Oct 31, 23:31:08 GMT+0 - Identified - Secret rotation is now available for RabbitMQ add-ons for all customers.\n\nPlease rotate all secrets if you have not already. Oct 31, 22:32:19 GMT+0 - Identif","summary":"Northflank, a hosted deployment platform, disclosed an attack in which an intruder decrypted secrets held in its control plane between 30 October and early November. The company says running workloads and workload data were not accessed, but some customers reported unauthorised use of AI provider keys.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Northflank","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-providers","byoc","cloud-credentials","incident","northflank","security","self-hosted","vendor"],"not_affected_if":["dedicated-control-plane","forward-deployed-control-plane"],"how_to_check":"- Review provider logs (AI providers, cloud, payment) for unexpected usage or spend since 30 October\n- Check whether your Northflank integration and project secrets were stored on the shared control plane (unknown if the sources do not say how to confirm this)","fix":"- Rotate all integration and project secrets in Northflank, starting with AI provider keys, cloud credentials, payment keys, private keys and database credentials\n- Sign in again and reconnect Northflank integrations, since access tokens, sessions and VCS integrations were revoked","status":"open","published_at":"2026-10-30T13:40:03+00:00","first_seen_at":"2026-11-08T16:58:27+00:00","triaged_at":"2026-11-08T16:59:11+00:00","updated_at":"2026-11-08T16:59:11+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T16:59:11Z","model":"claude-haiku-5-5","output":{"fix":"- Rotate all integration and project secrets in Northflank, starting with AI provider keys, cloud credentials, payment keys, private keys and database credentials\n- Sign in again and reconnect Northflank integrations, since access tokens, sessions and VCS integrations were revoked","reach":"internet","title":"Northflank: attacker decrypted customer secrets in control plane","impact":"high","summary":"Northflank, a hosted deployment platform, disclosed an attack in which an intruder decrypted secrets held in its control plane between 30 October and early November. The company says running workloads and workload data were not accessed, but some customers reported unauthorised use of AI provider keys.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["northflank","self-hosted","byoc","ai-providers","cloud-credentials"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker decrypts and reuses stored cloud, AI and database credentials","analyst_note":"Confirm the attack vector, the CVE-2026-98432 affected and fixed versions, and the root cause analysis when published at status.northflank.com.","how_to_check":"- Review provider logs (AI providers, cloud, payment) for unexpected usage or spend since 30 October\n- Check whether your Northflank integration and project secrets were stored on the shared control plane (unknown if the sources do not say how to confirm this)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["dedicated-control-plane","forward-deployed-control-plane"],"who_is_affected":"Teams that store secrets such as API keys, cloud credentials or database passwords in Northflank integrations or project secrets on the shared control plane. Customers on forward-deployed or dedicated control planes are stated to be unaffected, and workloads themselves are stated to have not been accessed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000924,"input_tokens":5750,"output_tokens":697,"severity_before":"unknown","breached_checked":true},"analyst_status":null,"analyst_note":null,"search":"'+0':88C,294C,648C,678C '-2026':398C '-98432':399C '02':128C '03':132C '08':133C,646C '09':85C,291C '10':84C '11':146C,290C '19':676C '2':289C '22':674C '23':644C '24/7':614C '30':43B,136C '31':643C,645C,673C '32':675C '38':86C '39':129C '43':147C '51':292C '6':83C '60':160C 'abl':532C 'access':58B,119C,366C,542C 'account':551C,556C 'across':400C 'act':534C 'activ':225C,410C,478C,509C 'add':658C 'add-on':657C 'addon':75C 'affect':71C 'ai':10B,66B,458C,483C,515C,521C 'ai-provid':9B 'alert':144C,309C 'alreadi':217C,561C,671C 'also':501C 'analysi':285C,636C 'anthrop':528C 'api':242C 'attack':30B,299C,317C,324C,331C,369C 'auditor':327C 'avail':234C,287C,654C 'began':328C 'behalf':537C 'believ':297C 'budget':231C,251C 'build':73C 'byoc':12B,404C,414C 'caus':284C,635C 'certif':81C 'channel':592C 'check':578C 'cloud':14B,486C 'cloud-credenti':13B 'cluster':405C,415C 'cmvv0rn5a092f14rutwccodpp':7A 'compani':49B 'compon':72C 'compromis':265C 'confirm':279C,640C 'connect':419C 'contact':423C,519C,584C 'contain':302C 'continu':340C 'control':40B,254C,380C,389C 'credenti':15B,201C,245C,266C,488C,499C 'cross':550C 'cross-account':549C 'custom':61B,96C,113C,165C,181C,382C,452C,662C 'cve':397C 'data':55B,117C,364C 'databas':495C 'day':429C 'decrypt':35B,123C 'dedic':388C 'degrad':173C,435C 'deploy':26B,386C 'direct':523C,591C 'disclos':28B 'done':218C 'earli':46B 'enabl':227C,255C 'endpoint':243C 'enforc':250C 'engin':151C 'entir':609C 'environ':321C 'even':471C 'everyth':580C 'evid':111C,370C 'exploit':156C 'faster':256C 'find':280C,641C 'first':121C,141C,308C 'fleet':402C 'focus':374C 'forens':271C,326C 'forward':385C 'forward-deploy':384C 'found':109C 'gmt':87C,293C,647C,677C 'harden':191C,443C 'haven':474C,559C 'held':37B,377C 'help':260C,570C,574C 'high':177C 'host':21B,25B 'hour':170C,305C 'iam':552C 'identif':679C 'identifi':649C 'impact':263C,344C 'inc':5A 'inc-northflank-cmvv0rn5a092f14rutwccodpp':4A 'incid':3A,16B,70C,103C,257C 'includ':403C 'independ':270C,325C 'integr':209C,411C,466C,547C,568C 'intend':630C 'intermitt':171C,433C 'intrud':34B 'investig':268C,311C 'ip':228C,247C 'job':79C 'keep':620C 'key':68B,187C,441C,485C,491C,493C 'known':122C 'last':427C 'limit':232C,252C,261C 'log':76C,222C,506C 'longer':418C 'mailto':586C 'metric':78C 'minut':154C,161C 'monitor':89C,295C 'need':448C,569C,573C 'network':74C 'next':617C 'northflank':1A,6A,8A,17B,23B,138C,334C,421C,541C 'notif':163C 'notifi':167C 'nov':82C,288C 'novemb':47B 'occur':126C,174C 'oct':642C,672C 'octob':44B,137C 'on':659C 'one':598C 'ongo':274C 'onlin':100C 'openai':526C 'oper':94C 'organis':610C 'page':623C 'patch':158C,396C 'payment':489C 'plane':41B,381C,390C 'platform':27B,91C,143C,172C,190C,434C,445C 'pleas':206C,422C,460C,663C 'possibl':203C 'privat':492C 'progress':627C 'project':211C,469C 'provid':11B,67B,198C,221C,237C,241C,484C,487C,490C,505C,522C 'rabbitmq':656C 'receiv':139C 'recommend':240C,480C,502C 'reconnect':566C 'redeploy':182C 'remain':93C,99C,273C 'report':62B,454C 'respond':152C 'respons':258C 'restrict':229C,248C 'review':220C,272C,329C,342C,503C,626C 'revoc':246C 'revok':200C,540C 'role':553C 'root':283C,634C 'rotat':188C,207C,438C,461C,575C,583C,651C,664C 'run':51B,348C 'say':50B 'secret':36B,125C,212C,376C,459C,463C,467C,470C,576C,650C,666C 'secur':2A,18B,142C 'seen':357C,476C,513C 'self':20B 'self-host':19B 'separ':393C 'servic':80C,498C,555C 'session':545C 'share':277C,632C 'show':312C 'sign':314C,359C,562C 'simultan':180C 'spend':518C 'start':481C 'strong':239C 'subsequ':186C 'suggest':371C 'support':424C 'support@northflank.com':585C,587C 'suspici':477C 'throughout':101C 'time':106C,354C 'togeth':332C 'token':543C 'treat':601C 'two':169C 'type':69C 'unaffect':351C,392C 'unauthoris':63B,455C 'unexpect':514C 'unusu':224C,508C 'updat':621C 'upstream':197C,236C 'urgenc':606C 'us':594C 'usag':516C 'use':64B,456C,589C 'user':205C 'utc':130C,134C,148C 'utmost':605C 'vcs':546C 'vector':300C 'vendor':22B 'volum':178C 'weekend':337C 'wherev':233C 'within':153C,159C,168C,303C 'work':192C,195C,613C 'workload':52B,54B,97C,114C,116C,347C,349C,361C,363C","nicknames":[],"mitigations":[],"who_affected":"Teams that store secrets such as API keys, cloud credentials or database passwords in Northflank integrations or project secrets on the shared control plane. Customers on forward-deployed or dedicated control planes are stated to be unaffected, and workloads themselves are stated to have not been accessed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["northflank"],"ptokens":["northflank"],"labels":["aiproviders","byoc","cloudcredentials","high","incident","northflank","security","selfhosted","vendor"],"campaign_type":null,"search_a":"'cmvv0rn5a092f14rutwccodpp':7A 'inc':5A 'inc-northflank-cmvv0rn5a092f14rutwccodpp':4A 'incid':3A 'northflank':1A,6A,8A 'secur':2A","search_b":"'30':43B 'access':58B 'ai':10B,66B 'ai-provid':9B 'attack':30B 'byoc':12B 'cloud':14B 'cloud-credenti':13B 'compani':49B 'control':40B 'credenti':15B 'custom':61B 'data':55B 'decrypt':35B 'deploy':26B 'disclos':28B 'earli':46B 'held':37B 'host':21B,25B 'incid':16B 'intrud':34B 'key':68B 'northflank':17B,23B 'novemb':47B 'octob':44B 'plane':41B 'platform':27B 'provid':11B,67B 'report':62B 'run':51B 'say':50B 'secret':36B 'secur':18B 'self':20B 'self-host':19B 'unauthoris':63B 'use':64B 'vendor':22B 'workload':52B,54B","search_c":"'+0':88C,294C,648C,678C '-2026':398C '-98432':399C '02':128C '03':132C '08':133C,646C '09':85C,291C '10':84C '11':146C,290C '19':676C '2':289C '22':674C '23':644C '24/7':614C '30':136C '31':643C,645C,673C '32':675C '38':86C '39':129C '43':147C '51':292C '6':83C '60':160C 'abl':532C 'access':119C,366C,542C 'account':551C,556C 'across':400C 'act':534C 'activ':225C,410C,478C,509C 'add':658C 'add-on':657C 'addon':75C 'affect':71C 'ai':458C,483C,515C,521C 'alert':144C,309C 'alreadi':217C,561C,671C 'also':501C 'analysi':285C,636C 'anthrop':528C 'api':242C 'attack':299C,317C,324C,331C,369C 'auditor':327C 'avail':234C,287C,654C 'began':328C 'behalf':537C 'believ':297C 'budget':231C,251C 'build':73C 'byoc':404C,414C 'caus':284C,635C 'certif':81C 'channel':592C 'check':578C 'cloud':486C 'cluster':405C,415C 'compon':72C 'compromis':265C 'confirm':279C,640C 'connect':419C 'contact':423C,519C,584C 'contain':302C 'continu':340C 'control':254C,380C,389C 'credenti':201C,245C,266C,488C,499C 'cross':550C 'cross-account':549C 'custom':96C,113C,165C,181C,382C,452C,662C 'cve':397C 'data':117C,364C 'databas':495C 'day':429C 'decrypt':123C 'dedic':388C 'degrad':173C,435C 'deploy':386C 'direct':523C,591C 'done':218C 'enabl':227C,255C 'endpoint':243C 'enforc':250C 'engin':151C 'entir':609C 'environ':321C 'even':471C 'everyth':580C 'evid':111C,370C 'exploit':156C 'faster':256C 'find':280C,641C 'first':121C,141C,308C 'fleet':402C 'focus':374C 'forens':271C,326C 'forward':385C 'forward-deploy':384C 'found':109C 'gmt':87C,293C,647C,677C 'harden':191C,443C 'haven':474C,559C 'held':377C 'help':260C,570C,574C 'high':177C 'hour':170C,305C 'iam':552C 'identif':679C 'identifi':649C 'impact':263C,344C 'incid':70C,103C,257C 'includ':403C 'independ':270C,325C 'integr':209C,411C,466C,547C,568C 'intend':630C 'intermitt':171C,433C 'investig':268C,311C 'ip':228C,247C 'job':79C 'keep':620C 'key':187C,441C,485C,491C,493C 'known':122C 'last':427C 'limit':232C,252C,261C 'log':76C,222C,506C 'longer':418C 'mailto':586C 'metric':78C 'minut':154C,161C 'monitor':89C,295C 'need':448C,569C,573C 'network':74C 'next':617C 'northflank':138C,334C,421C,541C 'notif':163C 'notifi':167C 'nov':82C,288C 'occur':126C,174C 'oct':642C,672C 'octob':137C 'on':659C 'one':598C 'ongo':274C 'onlin':100C 'openai':526C 'oper':94C 'organis':610C 'page':623C 'patch':158C,396C 'payment':489C 'plane':381C,390C 'platform':91C,143C,172C,190C,434C,445C 'pleas':206C,422C,460C,663C 'possibl':203C 'privat':492C 'progress':627C 'project':211C,469C 'provid':198C,221C,237C,241C,484C,487C,490C,505C,522C 'rabbitmq':656C 'receiv':139C 'recommend':240C,480C,502C 'reconnect':566C 'redeploy':182C 'remain':93C,99C,273C 'report':454C 'respond':152C 'respons':258C 'restrict':229C,248C 'review':220C,272C,329C,342C,503C,626C 'revoc':246C 'revok':200C,540C 'role':553C 'root':283C,634C 'rotat':188C,207C,438C,461C,575C,583C,651C,664C 'run':348C 'secret':125C,212C,376C,459C,463C,467C,470C,576C,650C,666C 'secur':142C 'seen':357C,476C,513C 'separ':393C 'servic':80C,498C,555C 'session':545C 'share':277C,632C 'show':312C 'sign':314C,359C,562C 'simultan':180C 'spend':518C 'start':481C 'strong':239C 'subsequ':186C 'suggest':371C 'support':424C 'support@northflank.com':585C,587C 'suspici':477C 'throughout':101C 'time':106C,354C 'togeth':332C 'token':543C 'treat':601C 'two':169C 'type':69C 'unaffect':351C,392C 'unauthoris':455C 'unexpect':514C 'unusu':224C,508C 'updat':621C 'upstream':197C,236C 'urgenc':606C 'us':594C 'usag':516C 'use':456C,589C 'user':205C 'utc':130C,134C,148C 'utmost':605C 'vcs':546C 'vector':300C 'volum':178C 'weekend':337C 'wherev':233C 'within':153C,159C,168C,303C 'work':192C,195C,613C 'workload':97C,114C,116C,347C,349C,361C,363C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-30T13:40:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"northflank:cmvv0rn5a092f14rutwccodpp","url":"https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp","severity":null,"published_at":"2026-10-30T13:40:03+00:00","modified_at":"2026-10-30T13:40:03+00:00","first_seen_at":"2026-11-08T16:58:27+00:00","fetched_at":"2026-11-09T02:40:07+00:00","note":null}],"documents":[],"disclosures":[{"company":"Northflank","domain":"status.northflank.com","url":"https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp","kind":"statuspage","published_at":"2026-10-30T13:40:03+00:00","quote":"The first known decryption of secrets occurred between 02:39 UTC and 03:08 UTC on 30 October.","confidence":0.8999999761581421,"source":"statuspage","created_at":"2026-11-08T17:12:33+00:00","entry":"unpatched-vuln"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}