# Bubble says an attacker accessed users' third-party API keys and tokens in an active security incident · pwn.watch > On Oct 26 2026, no-code platform Bubble posted on status.bubble.io that it is responding to an active security incident after detecting unauthorized access to parts of its systems. Bubble has confirmed the attacker accessed third-party tokens and credentials, such as API keys used in the API Connector and plugins, belonging to a subset of Bubble users, and says it is contacting affected users directly. As part of containment it may temporarily take parts of its infrastructure offline, which can affect both the Bubble editor and live Bubble apps. Bubble says the scope may change as the investigation continues and that official messages will come only from bubble.io and status.bubble.io. Page: https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026 · generated 2026-10-26T22:54:07.609Z ## Status - Severity: high · status: live · patch: partial - Product: Bubble (no-code app platform) - Started: 2026-10-26 - Affected: A subset of Bubble users whose third-party tokens and credentials (e.g. API Connector and plugin API keys) were accessed, per Bubble ## Follow this incident - RSS (one item per update): https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026.json - This file: https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026/llms.txt ## Updates (newest first) - 2026-10-26: Bubble posts an active security incident on its status page: it detected unauthorized access to parts of its systems and confirmed the attacker accessed third-party tokens and credentials (such as API keys used in API Connector and plugins) belonging to a subset of Bubble users. Bubble is contacting affected users and warns it may take parts of its infrastructure offline, affecting the editor and live apps, as part of containment. (https://status.bubble.io/) ## Fix brief # Security brief: Bubble says an attacker accessed users' third-party API keys and tokens in an active security incident Source: https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026 · status: live · severity: high · updated Oct 26, 2026, 20:53 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Oct 26 2026, no-code platform Bubble posted on status.bubble.io that it is responding to an active security incident after detecting unauthorized access to parts of its systems. Bubble has confirmed the attacker accessed third-party tokens and credentials, such as API keys used in the API Connector and plugins, belonging to a subset of Bubble users, and says it is contacting affected users directly. As part of containment it may temporarily take parts of its infrastructure offline, which can affect both the Bubble editor and live Bubble apps. Bubble says the scope may change as the investigation continues and that official messages will come only from bubble.io and status.bubble.io. Severity detail: Confirmed theft of users' third-party API keys and tokens; scope still under investigation - Product: Bubble (no-code app platform) ## Affected versions - A subset of Bubble users whose third-party tokens and credentials (e.g. API Connector and plugin API keys) were accessed, per Bubble ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you run apps on Bubble: review activity on every third-party account connected to your Bubble apps (API Connector and plugin keys) for unusual usage, and set spend limits where you can. Bubble says it will tell users when to rotate credentials so the new ones stay protected. Watch for phishing: official messages come only from bubble.io and status.bubble.io, and Bubble will never ask for your password or credentials by email. ## Latest updates - Oct 26, 2026: Bubble posts an active security incident on its status page: it detected unauthorized access to parts of its systems and confirmed the attacker accessed third-party tokens and credentials (such as API keys used in API Connector and plugins) belonging to a subset of Bubble users. Bubble is contacting affected users and warns it may take parts of its infrastructure offline, affecting the editor and live apps, as part of containment. ## Advisories - [Bubble Status: active security incident](https://status.bubble.io/) (Bubble) ## Write-ups & news - [Fede (Bubble) on the security incident](https://x.com/fede_bubble/status/2114817136975925743) ## Caveats Only source so far is Bubble's status page plus a Bubble team member's post on X. Bubble hasn't said how the attacker got in or how many users are affected. --- Machine-readable: https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.