Chainstack Traces Customer Data Breach to Exposed Admin Tools

TL;DR: Chainstack’s expanded incident report focuses on access-control failures.

Its recovery guidance makes completed credential rotation a priority.

Chainstack has added technical detail to the security incident it first disclosed on November 3.

Its updated report, with a technical section dated November 10, describes an October intrusion built around configuration and access-control failures.

The company says it found no evidence that a software vulnerability was exploited.

How the access controls failed According to Chainstack, the attacker entered through a development Grafana instance with unchanged default administrator credentials.

An unauthenticated tool server with broad Kubernetes permissions then formed part of the access path.

Machine credentials also connected the development and production environments.

The operational lesson is about the reach of an account after the first login.

A low-profile testing service can become consequential if it can contact sensitive systems or holds privileges that extend beyond its immediate job.

NewsBTC's coverage of the NEAR AI infrastructure incident explored a related boundary between an application and the services supporting it.

The mechanisms differ, but both make the surrounding infrastructure relevant to a crypto platform's security.

Continue reading at the original source →