Botpress disclosed on November 6, 2026 that an intruder used a flaw in an internal authentication proxy and an employee API credential to read bot configurations in 16 customer workspaces. The configurations can hold third-party credentials, and integration settings were changed in two additional workspaces.
Authentication Flaw Preceded Workspace Access
On October 12, 2026, someone began probing the authentication proxy protecting several internal tools. A flaw in its sign-in validation allowed the attacker to enter with sessions that appeared to belong to Botpress staff. From October 13 through October 21, 2026, the attacker had access to those tools and some connected systems, using that time to understand how Botpress’s systems worked. The access provided visibility into customer account information and internal data, including data related to staff API credentials. The investigation found no evidence that any employee’s identity-provider account was compromised.
On October 21, between 07:44 and 08:23 UTC, the attacker used the employee’s API credential and its administrator access to read configurations in 16 workspaces. The employee was a member of those customer workspaces and held administrator access to them. A bot’s configuration includes settings for installed integrations, which can contain AI provider API keys, messaging-channel tokens, CRM credentials and similar third-party secrets. Separately, weaknesses in some integrations’ setup flows were exploited to change one integration’s settings in each of two other customer workspaces.
Valid Credential Exposure Cannot Be Determined
Botpress knows which bots were read and has contacted owners of the 16 workspaces and the two where integration settings were changed, supplying lists of affected bots and integrations. Its logs cannot establish exactly which bots contained a valid credential when they were read. The company is therefore asking those customers to treat every credential stored in affected bots as exposed. For customers not contacted directly, the investigation has produced no evidence that their bots were read or changed.
Botpress attributes the intrusion to an effort to obtain AI usage for resale on AI black markets. The attacker operated a large network of Botpress accounts to consume AI credits before and during the incident, and much of the internal activity was intended to keep those accounts operating without limits. No ransom demand has been received, and there has been no observed sign that customer data was published or offered for sale.
The investigation also found no evidence of changes to source code, build pipelines or published packages, and no evidence of access to end-user conversations handled by customer bots. Botpress does not store full payment card numbers. The disclosure will be updated if these findings change.
Containment Is Complete but Remediation Continues
At approximately 16:25 UTC on October 21, Botpress fixed the proxy vulnerability, rotated its secret and revoked the employee credential. It blocked accounts, workspaces and network routes associated with the attacker, hardened ingress rules, restricted and restarted affected tools, and limited how those tools can be reached. It also reversed changes to internal settings, strengthened integration-configuration storage and started rotating internal credentials found in files the attacker read.
The attacker kept attempting access through other routes and new platform accounts after that fix. Botpress has closed every route it identified, and attempts observed through November 3, 2026 were rejected. The company says the internal tools can no longer be reached with a forged identity.
The remaining work extends beyond that containment. Internal credential rotation is still underway. A hardening initiative is reviewing access to every internal tool and staff-credential permissions, including when employees should hold administrator access to customer workspaces. Botpress is also changing the bot API so stored bot credentials cannot be reached through the same method again.
Monitoring for related activity will continue, and Botpress will work with affected customers until their credentials are rotated. That leaves a clear division between the incident’s immediate and unresolved phases: identified access routes have been closed, while credential rotation and decisions about staff access to customer workspaces remain unfinished.
Credit: Source link
