Botpress intrusion exposes bot configurations in 16 customer workspaces
An attacker bypassed a Botpress internal authentication proxy and used a staff API credential to read bot configurations in 16 customer workspaces. Integration settings were changed in two other workspaces. Affected customers should rotate credentials stored in the bots named in their notices.
- Disclosed
- Nov 6, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Botpress workspaces identified in direct notices, and third-party services whose credentials were stored in the affected bots.
- Botpress · SaaS · credentials
- In the wild
- Yes
- Botpress confirms configuration reads and integration changes in customer workspaces.
What happened
Botpress says the attacker reached internal tools by exploiting a flaw in the proxy that validated sign-ins. A staff API credential then granted access to bot configurations through the employee’s workspace memberships. Two other workspaces had one integration setting changed apiece through weaknesses in integration setup. The published counts are workspaces, and Botpress did not give a count of valid secrets obtained or report misuse at downstream providers.
Botpress says its logs could not establish which affected bots held valid credentials when read. It asks affected customers to treat every credential stored in the named bots as exposed. The company found no evidence of access to end-user conversations or staff identity-provider accounts, or of changes to its source code, build pipelines or published packages. It assesses that the attacker sought AI capacity for resale and reports no ransom demand or sign of publication or sale of customer data.
Crime-scene timeline
Oct 12, 2026
Probing begins against the internal authentication proxy
A sign-in validation flaw allowed sessions that appeared to belong to staff.
Oct 13–21, 2026
The attacker accesses internal tools and some connected systems
Botpress reports exposure of internal information about staff API credentials and visibility into customer account information.
Oct 21, 07:44–08:23 UTC
An employee credential is used to read bot configuration
The employee had administrative access through workspace membership. Botpress identified configuration reads in 16 workspaces during this window.
Oct 21, 2026
Botpress fixes the proxy and revokes the employee credential
Botpress fixed the proxy at about 16:25 UTC and also rotated its secret. It says the subsequent attempts it observed through November 3 were rejected.
Nov 6, 2026
Botpress publishes the incident report
The company discloses a separate integration change in each of two other workspaces. It says it contacted affected owners with the bots and integrations involved. Its internal rotation and hardening work continues.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Botpress incident reportPrimaryDescribes the proxy flaw, staff credential, two workspace groups, containment, scope limits and customer rotation request.
- Botpress Studio integration documentationPrimaryExplains how to open and configure an installed integration in Studio.