Northflank tells all users to rotate secrets after a security incident
Northflank tells all users to assume environment variables are compromised and rotate workload, secret-group and global credentials immediately. Its notice reports multiple users confirming AI-key use; investigation remains open, with no published root cause or victim count.
- Disclosed
- Oct 30, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- All Northflank users with credentials in workloads, secret groups or global secrets
- Northflank · cloud · credentials
- In the wild
- Yes
- Northflank reports multiple users confirming AI-key use; total scope remains unknown.
What happened
The platform-wide precaution is not proof every secret was stolen. The operator has not disclosed an entry point, attacker identity or complete exposure window. Network-policy patches are reported, but the notice does not declare containment complete or identify a software version that fixes customer exposure. Rotating only database credentials leaves other stored keys in scope.
Crime-scene timeline
Oct 30, 11:43 UTC
Wiz alert prompts investigation
Oct 30, 13:40 UTC
Northflank publicly requests immediate rotation
Oct 30, 15:12 UTC
Postgres and MongoDB secret rotation enabled for all users
Oct 30, 19:28 UTC
Broad rotation guidance remains; investigation ongoing
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.