OVHcloud CLI: same release tag, different plumbing
OVHcloud CLI release binaries replaced with credential-stealing builds on GitHub
A hijacked GitHub account replaced binaries on OVHcloud CLI releases 0.11.0–0.15.0. Investigators place the replacement window at 12:47–14:21 UTC on October 19. Source builds and Docker images were not replaced; running a poisoned binary exposes machine-readable secrets.
- Disclosed
- Oct 19, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Users who downloaded affected OVHcloud CLI release assets during the October 19 replacement window
- ovhcloud
- In the wild
- Yes
- Malicious release assets distributed through the official repository
What happened
A version pin alone did not prevent exposure: attackers changed the files behind existing release URLs. Reinstalling removes the binary, but cannot revoke secrets it already read. The number of downloads and the full initial-access path remain unknown. L4 reflects malicious distribution of a cloud administration tool.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| OVHcloud CLI | 0.16.0 | Clean immutable release with attestation |
Crime-scene timeline
Oct 19, 12:47–14:21 UTC
Existing GitHub release assets replaced and then removed
Oct 19, 17:16 UTC
Clean 0.16.0 release published with immutable assets
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- OVHcloud repository issue #300PrimaryReporter documents replaced release assets and build metadata
- OVHcloud 0.16.0 releasePrimaryPublished October 19; immutable release with attestation
- OpenSourceMalwarePrimaryReconstructs UTC exposure window; source builds and Docker unaffected; GlassWorm attribution remains an assessment