--- id: "INC-northflank-cmvv0rn5a092f14rutwccodpp" page: "https://infrastack.ai/live/INC-northflank-cmvv0rn5a092f14rutwccodpp" kind: "incident" aliases: [] title: "Northflank: Security incident" severity: "high" cvss: null epss: null exploited: false status: "open" category: "vendor" products: [{"name": "Northflank", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["ai-providers", "byoc", "cloud-credentials", "incident", "northflank", "security", "self-hosted", "vendor"] not_affected_if: ["dedicated-control-plane", "forward-deployed-control-plane"] published_at: "2026-10-30T13:40:03+00:00" first_seen_at: "2026-11-08T16:58:27+00:00" updated_at: "2026-11-08T16:59:11+00:00" sources: [{"source": "statuspage", "url": "https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp", "first_seen_at": "2026-11-08T16:58:27+00:00"}] exploit_sources: [] --- # Northflank: Security incident Link for people: https://infrastack.ai/live/INC-northflank-cmvv0rn5a092f14rutwccodpp (this .md is for agents) Northflank, a hosted deployment platform, disclosed an attack in which an intruder decrypted secrets held in its control plane between 30 October and early November. The company says running workloads and workload data were not accessed, but some customers reported unauthorised use of AI provider keys. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Northflank affected range not listed fixed no fixed version listed ## How to check - Review provider logs (AI providers, cloud, payment) for unexpected usage or spend since 30 October - Check whether your Northflank integration and project secrets were stored on the shared control plane (unknown if the sources do not say how to confirm this) ## Fix - Rotate all integration and project secrets in Northflank, starting with AI provider keys, cloud credentials, payment keys, private keys and database credentials - Sign in again and reconnect Northflank integrations, since access tokens, sessions and VCS integrations were revoked ## Timeline - 2026-10-30T13:40:03+00:00 confirmed by Northflank (statuspage) https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp "The first known decryption of secrets occurred between 02:39 UTC and 03:08 UTC on 30 October." - 2026-11-08T16:58:27+00:00 statuspage https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp ## From the sources Type: Incident Affected Components: Builds, Networking, Addons, Logs and Metrics, Jobs, Services, Certificates Nov 6, 10:09:38 GMT+0 - Monitoring - The platform has remained operational and customer workloads have remained online throughout the incident. At this time, we have found no evidence that customer workloads or workload data were accessed. The first known decryption of secrets occurred between 02:39 UTC and 03:08 UTC on 30 October. Northflank received its first security platform alert at 11:43 UTC, and our engineers responded within minutes. The exploit was patched within 60 minutes of notification, and customers were notified within two hours. Intermittent platform degradation occurred during a high volume of simultaneous customer redeployments and during our subsequent key rotation and platform hardening work. We have worked with upstream providers to revoke credentials where possible. **For users** Please rotate all integration and project secrets if you have not already done so, review provider logs for unusual activity, and enable IP restrictions and budget limits wherever available. **For upstream providers** We strongly recommend providing API endpoints for credential revocation, IP restrictions, and enforceable budget limits. These controls enable faster incident response and help limit the impact of compromised credentials. Our investigation and independent forensic review remain ongoing. We will share further confirmed findings and a root cause analysis once available. Nov 2, 11:09:51 GMT+0 - Monitoring - We believe the attack vector was contained within an hour of the first alert. Our investigation shows no sign that the attacker was in our environment after the attack. Independent forensic auditors began reviewing the attack together with Northflank over the weekend, and they continue to review it. Impact on your workloads Running workloads were unaffected. At this time we have seen no sign that workloads or workload data were accessed during the attack. Evidence suggests it was focused on secrets held in our control plane. Customers on forward-deployed or dedicated control planes are unaffected. Separately, we have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration. If your BYOC cluster is no longer connected to Northflank, please contact support. Over the last few days there has been intermittent platform degradation while we rotated our own keys and hardened the platform. What you need to do Some customers have reported unauthorised use of AI secrets. Please rotate all secrets now, both integration secrets and project secrets, even if you haven’t seen suspicious activity. We recommend starting with AI provider keys, cloud provider credentials, payment provider keys, private keys, and database and other service credentials. We also recommend reviewing your provider logs for unusual activity. If you have seen unexpected AI usage or spend, contact your AI providers directly, such as OpenAI and Anthropic. Where we were able to act on your behalf, we have revoked Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts. If you haven’t already, sign in again and reconnect your integrations. Need help? If you need help rotating secrets or checking that everything has been rotated, contact [support@northflank.com](mailto:support@northflank.com), or use your direct channel with us if you have one. We are treating this with the utmost urgency, and the entire organisation has been working 24/7. What’s next We will keep updating this page as the review progresses, and we intend to share a root cause analysis once we have confirmed findings. Oct 31, 23:31:08 GMT+0 - Identified - Secret rotation is now available for RabbitMQ add-ons for all customers. Please rotate all secrets if you have not already. Oct 31, 22:32:19 GMT+0 - Identif --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_