# Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed · pwn.watch > Luanti (formerly Minetest) says an attacker broke into ContentDB, its mod and game package site, by exploiting two vulnerabilities, one in a third-party component. From Oct 22 the attacker had the internal configuration and signed into a staff account, and from Oct 26 they could run commands inside the server container with full access to the database, secrets and uploads. Luanti took ContentDB offline on Oct 26, revoked all sessions, API tokens and GitHub OAuth tokens, and found no tampered uploads in backups but has not ruled it out. ContentDB stays offline for a week or more. Page: https://pwn.watch/i/luanti-contentdb-breach-oct-2026 · generated 2026-10-28T11:31:58.937Z ## Status - Severity: medium · status: live · patch: partial - Product: Luanti ContentDB (content.luanti.org) - Started: 2026-10-22 - Affected: ContentDB accounts (usernames, emails, bcrypt password hashes); Packages downloaded from ContentDB between Oct 22 and Oct 26 2026; IP addresses of downloads and in-game views in the two weeks before Oct 26 - Fixed in: ContentDB offline while vulnerable components are replaced; password and API token reset required when it returns ## Follow this incident - RSS (one item per update): https://pwn.watch/i/luanti-contentdb-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/luanti-contentdb-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/luanti-contentdb-breach-oct-2026.json - This file: https://pwn.watch/i/luanti-contentdb-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-10-27: Luanti discloses the incident and tells users to change reused passwords, watch for phishing posing as Luanti, and recheck anything downloaded from ContentDB between Oct 22 and Oct 26 against upstream sources or the unofficial mirror. ContentDB stays offline for a week or more. (https://blog.luanti.org/2026/10/27/contentdb-security-incident/) - 2026-10-26: The attacker gains command execution inside the ContentDB server container (from 00:15 UTC), with full access to the database, redis, secrets and uploads. Luanti discovers the break-in at 09:00 UTC, takes ContentDB offline and revokes all secrets, sessions, API tokens and GitHub OAuth tokens. (https://blog.luanti.org/2026/10/27/contentdb-security-incident/) - 2026-10-22: From 13:00 UTC the attacker has access to ContentDB internal configuration and signs into a staff account. At 17:35 UTC Luanti coincidentally patches one of the two exploited vulnerabilities, not yet knowing it was exploited. (https://blog.luanti.org/2026/10/27/contentdb-security-incident/) ## Fix brief # Security brief: Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed Source: https://pwn.watch/i/luanti-contentdb-breach-oct-2026 · status: live · severity: medium · updated Oct 28, 2026, 11:00 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Luanti (formerly Minetest) says an attacker broke into ContentDB, its mod and game package site, by exploiting two vulnerabilities, one in a third-party component. From Oct 22 the attacker had the internal configuration and signed into a staff account, and from Oct 26 they could run commands inside the server container with full access to the database, secrets and uploads. Luanti took ContentDB offline on Oct 26, revoked all sessions, API tokens and GitHub OAuth tokens, and found no tampered uploads in backups but has not ruled it out. ContentDB stays offline for a week or more. Severity detail: Full server and database access for days, including the secret key that could act as any account; passwords are bcrypt-hashed and no malicious uploads found so far - Product: Luanti ContentDB (content.luanti.org) ## Affected versions - ContentDB accounts (usernames, emails, bcrypt password hashes) - Packages downloaded from ContentDB between Oct 22 and Oct 26 2026 - IP addresses of downloads and in-game views in the two weeks before Oct 26 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - ContentDB offline while vulnerable components are replaced; password and API token reset required when it returns After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you have a ContentDB account, change that password anywhere you reused it. If you downloaded mods or games from ContentDB between Oct 22 and Oct 26 2026, redownload them or compare against upstream sources. Expect a forced password and API token reset when ContentDB returns. ## Latest updates - Oct 27, 2026: Luanti discloses the incident and tells users to change reused passwords, watch for phishing posing as Luanti, and recheck anything downloaded from ContentDB between Oct 22 and Oct 26 against upstream sources or the unofficial mirror. ContentDB stays offline for a week or more. - Oct 26, 2026: The attacker gains command execution inside the ContentDB server container (from 00:15 UTC), with full access to the database, redis, secrets and uploads. Luanti discovers the break-in at 09:00 UTC, takes ContentDB offline and revokes all secrets, sessions, API tokens and GitHub OAuth tokens. - Oct 22, 2026: From 13:00 UTC the attacker has access to ContentDB internal configuration and signs into a staff account. At 17:35 UTC Luanti coincidentally patches one of the two exploited vulnerabilities, not yet knowing it was exploited. ## Advisories - [URGENT: ContentDB security incident: 22–26 October 2026](https://blog.luanti.org/2026/10/27/contentdb-security-incident/) (Luanti) --- Machine-readable: https://pwn.watch/i/luanti-contentdb-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.