Northflank tells all users to assume their environment variables have been decrypted and to rotate every key after a security incident

Incident · Northflank (app and database hosting platform): environment variables, secrets on workloads, secret groups and global secrets · HIGH

Incident dateOct 30, 2026. The first event Northflank lists is "11:43 UTC: Wiz threat alert" (7:43 a.m. ET); it has not said when the incident began.

DisclosedOct 30, 2026, 1:40 PM UTC / 9:40 a.m. ET (Northflank status page).

Added hereOct 30, 2:08 PM ET

Last verifiedNov 5, 2026

Summary

Northflank, a platform for deploying apps, databases and jobs, declared a security incident on its status page on Oct 30, 2026 and told every user to rotate their secrets. At 1:40 PM UTC (9:40 a.m. ET) it posted: "Rotate environment variables immediately." At 1:58 PM UTC (9:58 a.m. ET) it wrote: "Assume all environment variables have been decrypted. Disable/rotate all keys." In its 3:12 PM UTC (11:12 a.m. ET) update it said "All users should assume their environment variables are decrypted and begin rotation immediately," listed secrets on workloads, secret groups and global secrets, and added: "Multiple users are confirming that their AI keys have been used." The timeline on the status page starts with "11:43 UTC: Wiz threat alert" (7:43 a.m. ET) and lists an initial network policy patch, further patching and a request for Wiz CIRT support. Seven Northflank Platform components, including Networking, Services, Addons and Builds, show "Major outage". Later updates add more. At 11:38 PM UTC (7:38 p.m. ET) it said "Users have reported unauthorised use of AI API keys supplied to the Northflank platform" and told users to revoke and replace their user-provided secrets and review their AI provider usage and billing logs. At 1:04 AM UTC on Oct 31 (9:04 p.m. ET on Oct 30) it said "We have enabled audit logs for all customers, including free users." At 1:34 PM UTC on Oct 31 (9:34 a.m. ET) it said "Secret rotation for MySQL and Redis is now available to all customers. Please rotate all secrets if you have not already." At 10:32 PM UTC on Oct 31 (6:32 p.m. ET) it said "Secret rotation for Minio Addons is now available to all customers," and at 11:31 PM UTC (7:31 p.m. ET) "Secret rotation is now available for RabbitMQ add-ons for all customers." On Nov 2, 2026 at 11:09 AM UTC (6:09 a.m. ET) it moved the incident to Monitoring and wrote: "We believe the attack vector was contained within an hour of the first alert." It said "Our investigation shows no sign that the attacker was in our environment after the attack," that "Independent forensic auditors began reviewing the attack together with Northflank over the weekend, and they continue to review it," and that "Evidence suggests it was focused on secrets held in our control plane." It also wrote: "At this time we have seen no sign that workloads or workload data were accessed during the attack." Separately it said: "we have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration." It again told customers: "Please rotate all secrets now, both integration secrets and project secrets, even if you haven't seen suspicious activity," and recommended starting with AI provider keys. It said it intends to share a root cause analysis once it has confirmed findings. When we last checked the status page at 2:03 p.m. ET on Nov 5, 2026, the incident was still marked Monitoring with Major outage impact, and seven Northflank Platform components still showed "Major outage."

Severity

HIGH High (VibeIncidents editorial rating). Northflank tells all users, not a subset, to assume their environment variables have been decrypted and to disable or rotate all keys, and it says "Multiple users are confirming that their AI keys have been used." We rate it High rather than Critical for now because Northflank has not confirmed that any secrets were actually decrypted or read, or how many users are affected: its platform-wide guidance is a precaution, and the reports of AI key use come from users, relayed by Northflank. Its Nov 2 update says the attack vector was believed contained and that evidence suggests a focus on control-plane secrets rather than workloads, but it still tells every customer to rotate all secrets and has not published a root cause analysis. We will revisit the rating if Northflank confirms how far the access went.

Timeline

Oct 30, 2026, 11:43 UTC (7:43 a.m. ET)
Per Northflank's status page: "11:43 UTC: Wiz threat alert". A minute later: "11:44 UTC: Northflank engineers review the alert".
Oct 30, 2026, 12:02 to 13:05 UTC (8:02 to 9:05 a.m. ET)
Northflank lists "12:02 UTC: Initial network policy patch", "12:50 UTC: Additional patching deployed", "13:00 UTC: Wiz CIRT support requested" and "13:05 UTC: Additional patching deployed" (the 13:05 line appears twice on the page). It has not said what the patches changed.
Oct 30, 2026, 1:40 PM UTC (9:40 a.m. ET)
Northflank opens a status incident titled "Security incident", marked Investigating: "Rotate environment variables immediately." The 11:43 to 13:05 UTC timeline is part of this update.
Oct 30, 2026, 1:58 PM UTC (9:58 a.m. ET)
The incident moves to Identified: "Assume all environment variables have been decrypted. Disable/rotate all keys."
Oct 30, 2026, 3:12 PM UTC (11:12 a.m. ET)
Northflank posts: "Secret rotation on Postgres and MongoDB has been enabled for all users. We recommend disabling public expose on addons if you have enabled that." It adds "All users should assume their environment variables are decrypted and begin rotation immediately," lists secrets on workloads, secret groups and global secrets, and says "Multiple users are confirming that their AI keys have been used."
Oct 30, 2026, 7:28 PM UTC (3:28 p.m. ET)
Northflank posts: "Our investigation is ongoing. We have no further confirmed findings to share at this time." It repeats its guidance to "assume all environment variables have been compromised and rotate all secrets and credentials immediately, including those in workloads, secret groups and global secrets."
Oct 30, 2026, 11:38 PM UTC (7:38 p.m. ET)
Northflank posts: "Users have reported unauthorised use of AI API keys supplied to the Northflank platform." It tells users to "Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank" and to "Review your AI provider usage and billing logs for unexpected activity." It adds: "These reports may be consistent with the broader pattern of attacks targeting AI credentials."
Oct 31, 2026, 1:04 AM UTC (Oct 30, 9:04 p.m. ET)
Northflank posts: "We have enabled audit logs for all customers, including free users."
Oct 31, 2026, 1:34 PM UTC (9:34 a.m. ET)
Northflank posts: "Secret rotation for MySQL and Redis is now available to all customers. Please rotate all secrets if you have not already."
Oct 31, 2026, 10:32 PM UTC (6:32 p.m. ET)
Northflank posts: "Secret rotation for Minio Addons is now available to all customers. Please rotate all secrets if you have not already."
Oct 31, 2026, 11:31 PM UTC (7:31 p.m. ET)
Northflank posts: "Secret rotation is now available for RabbitMQ add-ons for all customers. Please rotate all secrets if you have not already."
Nov 2, 2026, 11:09 AM UTC (6:09 a.m. ET)
Northflank moves the incident to Monitoring and posts a longer update. It writes: "We believe the attack vector was contained within an hour of the first alert. Our investigation shows no sign that the attacker was in our environment after the attack." It says "Independent forensic auditors began reviewing the attack together with Northflank over the weekend, and they continue to review it." On impact: "Running workloads were unaffected. At this time we have seen no sign that workloads or workload data were accessed during the attack. Evidence suggests it was focused on secrets held in our control plane. Customers on forward-deployed or dedicated control planes are unaffected." Separately: "we have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration." It again tells customers to rotate all secrets, starting with AI provider keys, and says it intends to share a root cause analysis once it has confirmed findings.
Nov 5, 2026, 2:03 p.m. ET
We re-check the status page (snapshot evidence/northflank-security-incident-2026-10/status-20261105-1403-ET.html). The incident is still marked Monitoring with Major outage impact. Seven Northflank Platform components still show "Major outage". The newest update remains the Nov 2, 11:09 AM UTC Monitoring post. Northflank has still not published a root cause analysis.

How it happened

Northflank has not published a root cause analysis. The timeline on Northflank's status page begins with "11:43 UTC: Wiz threat alert" and says Northflank engineers reviewed the alert a minute later. It then lists an "Initial network policy patch" at 12:02 UTC, more patching at 12:50 and 13:05 UTC, and "Wiz CIRT support requested" at 13:00 UTC. It does not say what the alert flagged or what the patches changed. What Northflank does say is that users should treat their secrets as exposed: "Assume all environment variables have been decrypted." Its 3:12 PM UTC update names three places secrets live on Northflank (secrets on workloads, secret groups and global secrets) and says "Multiple users are confirming that their AI keys have been used." Its 7:28 PM UTC update says "Our investigation is ongoing. We have no further confirmed findings to share at this time." Its 11:38 PM UTC update says "Users have reported unauthorised use of AI API keys supplied to the Northflank platform" and "These reports may be consistent with the broader pattern of attacks targeting AI credentials." In its Nov 2, 2026 11:09 AM UTC Monitoring update it wrote: "We believe the attack vector was contained within an hour of the first alert" and "Our investigation shows no sign that the attacker was in our environment after the attack." It said "Independent forensic auditors began reviewing the attack together with Northflank over the weekend, and they continue to review it." On impact it wrote: "Running workloads were unaffected. At this time we have seen no sign that workloads or workload data were accessed during the attack. Evidence suggests it was focused on secrets held in our control plane. Customers on forward-deployed or dedicated control planes are unaffected." Separately it said: "we have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration." It again asked customers to rotate all secrets and said it intends to share a root cause analysis once it has confirmed findings. The status page still shows Networking, Certificates, Services, Addons, Jobs, Builds, and Logs and Metrics in "Major outage", while the Northflank App, Northflank API, marketing site and documentation show "Operational". Northflank has not said how many users are affected. Claims on social media about who was behind the incident or why are not on Northflank's page, and we have left them out.

How to check your app

Rotate every secret you store on Northflank, starting now. Northflank says "All users should assume their environment variables are decrypted and begin rotation immediately" and tells users to "Disable/rotate all keys." Its Nov 2 update repeats: "Please rotate all secrets now, both integration secrets and project secrets, even if you haven't seen suspicious activity." It lists three places to cover: secrets on workloads, secret groups and global secrets. We suggest listing every key and password in those three places first, so none is missed.
For each external key (AI, cloud, payments, email and so on), Northflank says to "Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank." On Nov 2 it recommends starting with "AI provider keys, cloud provider credentials, payment provider keys, private keys, and database and other service credentials." We suggest revoking the old key only after your services use the new one, and checking that the old key no longer works.
Rotate database and addon credentials for Postgres, MongoDB, MySQL, Redis, Minio and RabbitMQ. Northflank says "Secret rotation on Postgres and MongoDB has been enabled for all users," then "Secret rotation for MySQL and Redis is now available to all customers," then "Secret rotation for Minio Addons is now available to all customers," and "Secret rotation is now available for RabbitMQ add-ons for all customers." Its API docs say most rotations create new credentials "with the same permissions; the old credentials remain valid until the rotation is finalised," so we suggest finalising once your services use the new ones. Redis and MinIO work differently: the docs say both restart and finish in one step, and for Redis "old credentials are revoked and clients must reconnect with the new password," so plan for a short interruption and redeploy linked services.
Turn off public access to your databases and other addons. Northflank says: "We recommend disabling public expose on addons if you have enabled that."
Check your AI providers' usage and billing for activity you do not recognize. Northflank says "Users have reported unauthorised use of AI API keys supplied to the Northflank platform" and, on Nov 2, "Some customers have reported unauthorised use of AI secrets." It asks users to "Review your AI provider usage and billing logs for unexpected activity" and, on Nov 2, to contact providers such as OpenAI and Anthropic if they have seen unexpected AI usage or spend. We also suggest checking logs and billing at every other provider whose keys you stored on Northflank, and setting spending limits where the provider offers them.
Review your Northflank audit logs and re-connect integrations. Northflank says "We have enabled audit logs for all customers, including free users." On Nov 2 it also said that where it was able to act on customers' behalf it revoked "Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts," and told users to "sign in again and reconnect your integrations" if they have not already. We suggest looking for changes to secrets, deployments and other actions that you do not recognize.
We suggest following Northflank's status page for further updates. As of our Nov 5, 2026 2:03 p.m. ET check, the incident was still marked Monitoring with Major outage impact. Northflank said on Nov 2 that it intends to share a root cause analysis once it has confirmed findings; that analysis was not on the status page yet.

Sources

Corrections and updates

Oct 31, 2026
Updated at 10:34 a.m. ET on Oct 31 with four later Northflank status updates: no further confirmed findings (Oct 30, 3:28 p.m. ET); user reports of unauthorised use of AI API keys supplied to the platform (7:38 p.m. ET); audit logs enabled for all customers (9:04 p.m. ET); and secret rotation for MySQL and Redis (Oct 31, 9:34 a.m. ET). Northflank still has not given a cause.
Nov 5, 2026
Updated with Northflank's Nov 2, 2026 Monitoring update (11:09 AM UTC, 6:09 a.m. ET). Northflank says it believes the attack vector was contained within an hour of the first alert, that its investigation shows no sign the attacker was in its environment after the attack, that independent forensic auditors are reviewing it, that evidence suggests a focus on control-plane secrets, and that it has seen no sign workloads or workload data were accessed. It also says it patched CVE-2026-98432 across its fleet. Added the Oct 31 secret rotation updates for Minio and RabbitMQ. At our Nov 5, 2:03 p.m. ET check the incident was still marked Monitoring with Major outage impact, and no root cause analysis had been published.

Cite this entry

Title: Northflank tells all users to assume their environment variables have been decrypted and to rotate every key after a security incident
Added: Oct 30, 2026
URL: https://vibeincidents.com/incidents/northflank-security-incident-2026-10/
Suggested citation: VibeIncidents. "Northflank tells all users to assume their environment variables have been decrypted and to rotate every key after a security incident." Oct 30, 2026. https://vibeincidents.com/incidents/northflank-security-incident-2026-10/