BreachPublished 21 Sep 2026

CrowdSec Confirms Source Code Stolen in Supply Chain Attack

Source SecurityWeek

supply-chain

Description

French cybersecurity firm CrowdSec confirmed that approximately 300 of its GitHub repositories, including about 170 private ones, were compromised in a supply chain attack linked to the May 2026 TanStack incident. Source code for CrowdSec's SaaS console, AWS Cloud routines, connectors, and automations was stolen. No customer credentials or data were leaked, and the stolen code cannot be used out of context to cause harm. CrowdSec rotated all potentially affected tokens and credentials immediately after discovery and continues to monitor for abnormal activity.

Impact

The breach resulted in the theft of CrowdSec's internal source code but did not expose customer credentials or data. The stolen code is considered of limited risk as it cannot be used outside CrowdSec's environment or without its data and tools. The incident may pose a risk to CrowdSec's intellectual property and could potentially aid attackers in understanding the company's internal architecture, but no immediate threat to customers or external systems was identified.

Defensive guidance

CrowdSec has rotated all potentially compromised API keys and credentials immediately following the breach. The company regularly audits its source code and monitors for abnormal activity. No further action is currently required as the stolen code cannot be exploited independently. Organizations using CrowdSec should remain informed through official communications but no direct mitigation steps are necessary for customers.

Summary

In May 2026, CrowdSec was impacted by a supply chain attack originating from the TanStack ecosystem, where malicious artifacts compromised an API key used by CrowdSec. This allowed attackers to access and exfiltrate source code from roughly 300 private and public GitHub repositories, including critical internal components such as the SaaS console and AWS automation scripts. CrowdSec confirmed no customer data or credentials were exposed and stated that the stolen code cannot be exploited independently without the associated environment and data. The company promptly rotated credentials and continues to monitor for suspicious activity. The breach is attributed to the short exploitation window during the TanStack supply chain compromise.

References

securityweek.com/crowdsec-confirms-source-code-stolen-in-supply-chain-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Sep 2026, 11:01 UTC

References

Community reviews

Related threats