Short answer: Chainstack customers' account details and password hashes were exposed. Customers should change passwords and rotate node credentials.
TL;DR
- Chainstack reported a breach affecting customer data and passwords.
- Zammad faced two zero-day vulnerabilities exploited by attackers.
- These attacks used AI to automate parts of the intrusion.
What is CVE-2026-102489?
Chainstack, WorkOS, and Zammad experienced security incidents where attackers used advanced AI techniques to gain unauthorized access. In Chainstack's case, customer account information and password hashes were exposed. These attacks highlight the growing use of AI in cybersecurity threats, emphasizing the need for robust security measures and timely updates.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Data breach
- When private information is stolen or exposed to people who should not see it.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 03 Nov 2026 |
| CVE | CVE-2026-102489 |
| CVSS | 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X |
| Weakness | CWE-384 (see NVD) |
| CISA KEV | Yes, added 2026-10-02; federal due date 2026-10-05 |
| Ransomware use | Unknown (CISA KEV) |
| Vendor advisory | community.zammad.org |
| CVE | CVE-2026-102490 |
| CVSS | 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X |
| Weakness | CWE-269 (improper privilege management) |
| CISA KEV | Yes, added 2026-10-02; federal due date 2026-10-05 |
| Ransomware use | Unknown (CISA KEV) |
| Vendor advisory | github.com |
| Affected product | Zammad GmbH Zammad |
| Published in NVD | 2026-09-30 (CVE-2026-102489) |
| Published in NVD | 2026-09-30 (CVE-2026-102490) |
How it works
AI-powered attacks use advanced software to automate and speed up hacking. These tools can analyze data, choose targets, and carry out attacks. They can exploit vulnerabilities faster than humans, making them harder to detect and stop.
- Attacker reaches the Zammad GmbH Zammad over the internet / network
- No login or account is needed
- A user must open a link or file first
- Sends crafted input that triggers the flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-09-30 | CVE-2026-102489 published in NVD | NVD |
| 2026-09-30 | CVE-2026-102490 published in NVD | NVD |
| 2026-10-02 | CVE-2026-102489 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-10-02 | CVE-2026-102490 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-10-05 | US federal agencies must patch by this date | CISA KEV |
| 2026-11-03 | Reported by The Hacker News | The Hacker News |
| 2026-11-08 | This Skillmate explainer published | Skillmate |
How to fix it
- Update Zammad GmbH Zammad to the fixed release named in the vendor advisory.
- Read the vendor advisory for CVE-2026-102489 and upgrade to the fixed release it lists.
- CVE-2026-102489 is in CISA KEV: treat it as actively exploited and patch first.
- Read the vendor advisory for CVE-2026-102490 and upgrade to the fixed release it lists.
- CVE-2026-102490 is in CISA KEV: treat it as actively exploited and patch first.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Defenders should look for unusual logins, unexpected API calls, and failed login attempts.
What is confirmed
- CVE-2026-102489 is a real NVD record scored 9.4 CRITICAL
- CISA lists CVE-2026-102489 as exploited in the wild
- CVE-2026-102490 is a real NVD record scored 9.4 CRITICAL
- CISA lists CVE-2026-102490 as exploited in the wild
- Reported by The Hacker News
- Reported by workos.com
- Reported by community.zammad.org
- Reported by github.com
- Reported by chainstack.com
Why it matters
AI-assisted attacks are growing. They can target high-value firms and use stolen credentials to gain unauthorized access. Companies must stay vigilant, update systems, and use strong passwords to protect against these threats.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is a false positive in cybersecurity?
A false positive is a security alert that incorrectly identifies normal activity as a threat. For example, a user logging in from a different location than usual might trigger an alert.
How can I protect my data after a breach?
You should change passwords, rotate node credentials, and regenerate platform API keys. Also, be cautious of phishing attempts.
What are the main risks of using AI in cyber attacks?
AI can automate attacks, making them faster and more scalable. This increases the risk of exploiting weaknesses in systems and credentials.
Related Skillmate posts
Sources
- Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes (The Hacker News)
- Primary source / advisory (workos.com)
- Vendor advisory CVE-2026-102489 (community.zammad.org)
- Vendor advisory CVE-2026-102490 (github.com)
- Chainstack (primary source) (chainstack.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.