# Northflank: rotate project and integration secrets after incident

Canonical: https://www.oktsec.com/radar/northflank-secrets-incident-october-2026
Publisher: Oktsec
Language: en
Published: 2026-11-03T17:00:17Z
Updated: 2026-11-03T17:00:17Z
Record reviewed: 2026-11-03T17:00:17Z
Latest evidence check: 2026-11-03T17:00:17Z
Disclosed: 2026-10-30

Northflank still requires secret rotation after containment of its October 30 incident. Customers have reported unauthorized AI-key use.

## Evidence and response priority

- Category: Platform incident
- Oktsec priority: Act now
- Rationale: The provider still requires all project and integration secrets to be rotated; containment does not revoke copied credentials.
- Evidence: Incident confirmed by provider
- Verification: Vendor confirmed
- Fix status: Not applicable
- Exposure requirement: Credentials stored with provider
- Vendor: Northflank
- Products: Northflank

## Technical overview

Northflank’s November 2 update says the investigation points to control-plane secrets, with no evidence of workload-data access. Forward-deployed and dedicated control planes are outside the stated scope. These are provider findings, with independent forensic review continuing.

Containment does not invalidate credentials already copied. Treat rotation as a separate recovery task with a named owner and completion evidence. The Linux patch mentioned in the status update is not presented as a confirmed root cause.

## Recommended response

Rotate project and integration secrets; review provider usage and billing.

Relevant to: Teams responsible for the affected deployments.

## Response checklist

1. **Confirm the control-plane scope** — Identify which projects and integrations use the affected service.
2. **Revoke and replace secrets** — Prioritize AI, cloud, payment, private-key and database credentials. Replace them at the issuer and update dependent workloads.
3. **Review usage and restore integrations** — Check provider logs and unexpected spend; reconnect integrations revoked by Northflank.
4. **Record completion** — Assign each credential an owner; verify old access fails and dependent services still work.

## Relevance to AI environments

Include automated workflows in the response inventory; the evidence does not establish AI involvement in the attack.

## Sources

- [Northflank incident updates and rotation guidance](https://status.northflank.com/) — Northflank; Vendor notice; checked 2026-11-03T17:00:17Z

## Editorial record

- 2026-11-03T17:00:17Z: Added source scope and a practical response checklist.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/northflank-secrets-incident-october-2026) · [Build a response plan](https://www.oktsec.com/radar/northflank-secrets-incident-october-2026#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=northflank-secrets-incident-october-2026&service=exposure_check)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.