# GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secrets · pwn.watch > On Nov 2 2026 an attacker used a flaw in GitBook's SSO login flow to create sessions as GitBook staff, pulled credentials for a misconfigured internal GitHub App to reach GitBook's code repositories and a Cloudflare API key, and from there reached production secrets with full infrastructure access. GitBook took its app offline for about 16 hours (20:32 UTC Nov 2 to 11:56 UTC Nov 3), rotated every infrastructure and GitBook-managed customer secret, and invalidated all API tokens. It says the attack targeted one customer, but treats all customer data as exposed: API tokens, integration tokens and secrets, session signing secrets, authenticated-access docs, content, and the ability to act as the GitBook GitHub and GitLab apps in repositories customers had granted. GitBook says it can't tell whether the attacker acted in customer repositories. Billing data and passwords were not affected. Customers should create new API tokens, rotate third-party and integration secrets, regenerate authenticated-access signing keys, re-authenticate the GitBook MCP server, review connected repositories, and check logs for the published IPs. Page: https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026 · generated 2026-11-04T23:11:58.039Z ## Status - Severity: high · status: live · patch: partial - Product: GitBook (hosted documentation platform) - Started: 2026-11-02 - Affected: GitBook customers with API tokens, integrations, Git Sync (GitHub or GitLab), authenticated-access docs or the GitBook MCP server - Fixed in: SSO flaw fixed Nov 2 2026 and all GitBook-side secrets rotated by Nov 3; customers must rotate their own tokens and secrets ## Follow this incident - RSS (one item per update): https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026.json - This file: https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026/llms.txt ## Updates (newest first) - 2026-11-04: GitBook publishes its post-mortem: all customer data treated as exposed, no evidence other customers' content was modified, and three attacker IP addresses published as indicators of compromise. (https://www.gitbook.com/status/security-incident-2026-11-03) - 2026-11-03: GitBook invalidates all existing API tokens, rotates GitHub app keys, and is fully back online at 11:56 UTC after about 16 hours of downtime; customers get rotation instructions. (https://www.gitbook.com/status/security-incident-2026-11-03) - 2026-11-02: Attacker hijacks an account at the targeted customer (12:27 UTC), gets staff sessions through an SSO flaw and source code access (16:32), and reaches production (17:48); GitBook fixes the SSO flaw (19:58) and takes the app offline (20:32). (https://www.gitbook.com/status/security-incident-2026-11-03) ## Fix brief # Security brief: GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secrets Source: https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026 · status: live · severity: high · updated Nov 4, 2026, 21:17 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Nov 2 2026 an attacker used a flaw in GitBook's SSO login flow to create sessions as GitBook staff, pulled credentials for a misconfigured internal GitHub App to reach GitBook's code repositories and a Cloudflare API key, and from there reached production secrets with full infrastructure access. GitBook took its app offline for about 16 hours (20:32 UTC Nov 2 to 11:56 UTC Nov 3), rotated every infrastructure and GitBook-managed customer secret, and invalidated all API tokens. It says the attack targeted one customer, but treats all customer data as exposed: API tokens, integration tokens and secrets, session signing secrets, authenticated-access docs, content, and the ability to act as the GitBook GitHub and GitLab apps in repositories customers had granted. GitBook says it can't tell whether the attacker acted in customer repositories. Billing data and passwords were not affected. Customers should create new API tokens, rotate third-party and integration secrets, regenerate authenticated-access signing keys, re-authenticate the GitBook MCP server, review connected repositories, and check logs for the published IPs. Severity detail: Full production infrastructure access; all customer tokens and integration secrets treated as exposed; GitBook could act as its Git apps in customer repos - Product: GitBook (hosted documentation platform) ## Affected versions - GitBook customers with API tokens, integrations, Git Sync (GitHub or GitLab), authenticated-access docs or the GitBook MCP server ## Check whether you're affected Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions: ```sh sudo gitlab-rake gitlab:env:info ``` ## Fix Upgrade to one of these fixed versions (or later on the same branch): - SSO flaw fixed Nov 2 2026 and all GitBook-side secrets rotated by Nov 3; customers must rotate their own tokens and secrets After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Published IOCs: 94.183.188.91, 45.139.84.195, 198.251.83.217. Git Sync keys for GitHub and GitLab were rotated by GitBook (no customer action). Close once GitBook's promised follow-up write-up lands and it's quiet. ## Latest updates - Nov 4, 2026: GitBook publishes its post-mortem: all customer data treated as exposed, no evidence other customers' content was modified, and three attacker IP addresses published as indicators of compromise. - Nov 3, 2026: GitBook invalidates all existing API tokens, rotates GitHub app keys, and is fully back online at 11:56 UTC after about 16 hours of downtime; customers get rotation instructions. - Nov 2, 2026: Attacker hijacks an account at the targeted customer (12:27 UTC), gets staff sessions through an SSO flaw and source code access (16:32), and reaches production (17:48); GitBook fixes the SSO flaw (19:58) and takes the app offline (20:32). ## Advisories - [Security incident: post mortem](https://www.gitbook.com/status/security-incident-2026-11-03) (GitBook) ## Write-ups & news - [Security Incident Post Mortem (discussion)](https://news.ycombinator.com/item?id=50371545) --- Machine-readable: https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.