Bubble says an attacker accessed users' third-party API keys and tokens in an active security incident
Bubble (no-code app platform)
On Oct 26 2026, no-code platform Bubble posted on status.bubble.io that it is responding to an active security incident after detecting unauthorized access to parts of its systems. Bubble has confirmed the attacker accessed third-party tokens and credentials, such as API keys used in the API Connector and plugins, belonging to a subset of Bubble users, and says it is contacting affected users directly. As part of containment it may temporarily take parts of its infrastructure offline, which can affect both the Bubble editor and live Bubble apps. Bubble says the scope may change as the investigation continues and that official messages will come only from bubble.io and status.bubble.io.
Why this severity: Confirmed theft of users' third-party API keys and tokens; scope still under investigation
- Started
- Oct 26, 2026
Affected
- A subset of Bubble users whose third-party tokens and credentials (e.g. API Connector and plugin API keys) were accessed, per Bubble
Fixed in
No fixed release yet
Timeline1
Advisories1
News & write-ups1
Posts1
I guess it was our turn after @Railway caught the spotlight last week. Unfortunately @bubble experienced a security incident today and the team is working on hardening every surface. We'll continue sharing updates periodically and will reach out to any impacted users t.co/ZJRwLVcOlT
Notes & caveats
Only source so far is Bubble's status page plus a Bubble team member's post on X. Bubble hasn't said how the attacker got in or how many users are affected.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
