OVHcloud CLI Compromised in GitHub Supply Chain Attack

On October 19, 2026, an attacker compromised a developer's GitHub account and distributed malicious command-line interface (CLI) binaries through OVHcloud’s official repository[3][7]. The compromised files were available for 94 minutes and downloaded approximately 250 times before OVHcloud blocked them[1][5].

This incident reveals vulnerabilities in software supply chain security. Users who downloaded affected versions of the OVHcloud CLI face a risk of having sensitive data stolen, requiring immediate action to protect their credentials[1][3].

What the records show

The attacker bypassed OVHcloud’s continuous integration and continuous delivery (CI/CD) pipelines by using the hijacked developer’s GitHub account to upload locally built malicious packages directly to existing releases[2][8]. The core vulnerability was that the GitHub repository lacked the “release immutability” option. This setting allowed existing releases to be modified without additional checks[2][5]. The malicious binary was designed to steal secrets from users’ systems, including API keys, cloud credentials, and SSH keys[1][3]. OVHcloud CEO Octave Klaba acknowledged the binary was “poor quality” but confirmed it could effectively steal secrets[3][5]. The compromised versions of the CLI included v0.11.0 through v0.15.0. Version v0.10.0 and the newly released v0.16.0 were not affected[4][6]. The attacker did not compromise the developer's OVHcloud laptop, but used stolen keys[9].

The timeline

Malicious files were uploaded to the OVHcloud CLI GitHub repository at 12:47 UTC on October 19, 2026[7]. These files replaced downloadable archives across five existing releases for macOS, Linux, and Windows platforms[7]. A customer publicly reported the issue on GitHub at 13:50 UTC after their automated hash check failed in a continuous integration pipeline[7][10]. OVHcloud detected and blocked the malicious files by 14:21 UTC, making them available for approximately 94 minutes[1][7]. A new, clean, and immutable release, v0.16.0, was published at 17:16 UTC under OVHcloud’s ovh-cds account with a signed tag[7]. OVHcloud released a post-mortem detailing the incident on October 20, 2026[1].

What changed and for whom

OVHcloud has since enabled the “release immutability” option across all its repositories to prevent similar incidents[2][5]. For users who downloaded the affected CLI versions, OVHcloud strongly advised updating or deleting the software[3][4]. The company also recommended “change all the secrets stored on your disk,” including rotating API keys, cloud credentials, and SSH keys, preferably from a different, clean machine[1][3]. OVHcloud further advised pinning checksums for third-party binaries and building Go tools from the module proxy as preventative measures[1]. The new v0.16.0 release includes release attestation to ensure its integrity[7][13].

What OVHcloud has said publicly

OVHcloud CEO Octave Klaba confirmed the incident on X on October 19, 2026[3][5]. He stated that the hacker used a developer’s GitHub account to add a binary designed to retrieve secrets from the disk[3][5]. Klaba urged users who downloaded affected CLI versions to update or delete them immediately and to “change all the secrets stored on your disk”[3][4]. In a follow-up post, Klaba noted that the company’s CI/CD pipelines were not impacted. He added that the issue stemmed from the lack of the release immutability option on GitHub, which has now been enabled[2][9].

What we could not confirm

It is unclear if the attacker associated with the OVHcloud CLI compromise in October 2026 is the same actor responsible for a separate compromise of the developer’s GitHub account in March 2026, which researchers have linked to the GlassWorm threat actor[6][8]. OVHcloud has not publicly mentioned GlassWorm in its statements regarding this incident[6]. While the attacker used stolen keys, it is not confirmed how the developer’s GitHub account credentials were initially compromised[9].