Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed
Luanti ContentDB (content.luanti.org)
Luanti (formerly Minetest) says an attacker broke into ContentDB, its mod and game package site, by exploiting two vulnerabilities, one in a third-party component. From Oct 22 the attacker had the internal configuration and signed into a staff account, and from Oct 26 they could run commands inside the server container with full access to the database, secrets and uploads. Luanti took ContentDB offline on Oct 26, revoked all sessions, API tokens and GitHub OAuth tokens, and found no tampered uploads in backups but has not ruled it out. ContentDB stays offline for a week or more.
Why this severity: Full server and database access for days, including the secret key that could act as any account; passwords are bcrypt-hashed and no malicious uploads found so far
- Started
- Oct 22, 2026
Affected
- ContentDB accounts (usernames, emails, bcrypt password hashes)
- Packages downloaded from ContentDB between Oct 22 and Oct 26 2026
- IP addresses of downloads and in-game views in the two weeks before Oct 26
Fixed in
- ContentDB offline while vulnerable components are replaced; password and API token reset required when it returns
Timeline3
Luanti discloses the incident and tells users to change reused passwords, watch for phishing posing as Luanti, and recheck anything downloaded from ContentDB between Oct 22 and Oct 26 against upstream sources or the unofficial mirror. ContentDB stays offline for a week or more.
The attacker gains command execution inside the ContentDB server container (from 00:15 UTC), with full access to the database, redis, secrets and uploads. Luanti discovers the break-in at 09:00 UTC, takes ContentDB offline and revokes all secrets, sessions, API tokens and GitHub OAuth tokens.
From 13:00 UTC the attacker has access to ContentDB internal configuration and signs into a staff account. At 17:35 UTC Luanti coincidentally patches one of the two exploited vulnerabilities, not yet knowing it was exploited.
Advisories1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
