Bubble

Security incidents tagged Bubble. Newest first.

1 Bubble incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

HighPartly patched
Bubble says an attacker accessed users' third-party API keys and tokens in an active security incident
On Oct 26 2026, no-code platform Bubble posted on status.bubble.io that it is responding to an active security incident after detecting unauthorized access to parts of its systems. Bubble has confirmed the attacker accessed third-party tokens and credentials, such as API keys used in the API Connector and plugins, belonging to a subset of Bubble users, and says it is contacting affected users directly. As part of containment it may temporarily take parts of its infrastructure offline, which can affect both the Bubble editor and live Bubble apps. Bubble says the scope may change as the investigation continues and that official messages will come only from bubble.io and status.bubble.io.
Bubble (no-code app platform)Since Oct 26, 2026updated Oct 26, 2026, 20:53 UTC

Bubble says an attacker accessed users' third-party API keys and tokens in an active security incident
Fede
@fede_bubble
I guess it was our turn after @Railway caught the spotlight last week. Unfortunately @bubble experienced a security incident today and the team is working on hardening every surface. We'll continue sharing updates periodically and will reach out to any impacted users t.co/ZJRwLVcOlT
Oct 26, 2026view on x