OVHcloud CLI Had Compromised Release Archives; Users Should Rotate Secrets

OVHcloud CLI compromise affected release assets published on GitHub. An attacker replaced archives attached to existing tool releases, with OVHcloud identifying versions v0.11.0 through v0.15.0 as compromised. According to the company, the malicious binary could obtain secrets stored on the disk of the device on which it was run.

The incident affects only installations or updates in which a user downloaded and ran the replaced release assets during the window on October 19, 2026, approximately between 12:47 and 14:21 UTC. According to available information, users who did not install or update the tool from the affected attachments during this time were not affected by this specific incident.

OVHcloud CLI compromise involved release attachments

Available findings do not indicate changes to the source code, Git tags, or official build pipeline. The altered files were reportedly the binary archives attached directly to existing GitHub releases. This therefore represents a supply-chain attack in which a user may obtain a malicious file even when checking an older tag or the project’s source code.

OVHcloud removed the affected files and released version v0.16.0 on October 19. GitHub identifies it as an immutable release, meaning its release assets cannot be changed afterward. This version is intended as a trusted replacement for the compromised releases.

What affected users should do

According to OVHcloud, simply removing the suspicious binary is not sufficient. If the tool was downloaded and run during the stated time window, the user should reinstall the trusted version v0.16.0 and change locally stored secrets.

• Check whether the workstation or CI environment downloaded and ran OVHcloud CLI versions v0.11.0 through v0.15.0 during the affected window.
• Replace the installation with the trusted version v0.16.0.
• Rotate API keys, cloud credentials, and other secrets that may have been stored locally on the affected system.
• Monitor further guidance from OVHcloud, particularly any indicators of compromise, hashes of malicious files, and detection recommendations.

The risk is not limited to individual developer computers. CLI tools are also frequently used in automated CI environments, where they may have access to API tokens, cloud credentials, or other data needed to deploy and manage infrastructure.

What has not been confirmed so far

OVHcloud has not publicly confirmed how the contributor’s GitHub account, through which the release assets may have been replaced, was taken over. The number of systems on which the malicious binary was run is also unknown, as is which specific secrets may have been obtained or exfiltrated.

Some technical reports have suggested a possible connection to the GlassWorm group. OVHcloud has not confirmed this attribution, so it cannot yet be considered verified.

The case highlights the difference between source-code integrity and the integrity of distributed binary artifacts. When automatically downloading release files, it is useful to verify hashes and use mechanisms that limit subsequent changes to already published attachments.

Verified and updated: October 20, 2026 15:20