ClickUp’s Hardcoded API Key Exposes 959 Emails from Fortune 500 Giants

Cybersecuritynews •Guru Baran • April 27, 2026

A publicly accessible JavaScript file on ClickUp’s homepage has been silently leaking nearly a thousand corporate and government email addresses, including employees from Fortinet, Depot, Tenable, Mayo Clinic, and U.S. state government workers, through a hardcoded third-party API key that was first reported in January 2025 and remains unrotated as of April 2026. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClickUp API Key Vulnerability Exposes 959 Emails from Fortune 500 Firms A security vulnerability in ClickUp has led to the exposure of 959 email addresses associated with major Fortune 500 companies and government agencies. The issue arises from a hardcoded Split.io SDK token in ClickUp’s production JavaScript bundle, which is automatically loaded when users access the platform. This vulnerability was first reported in January 2025 and has not been addressed as of April 2026. Affected organizations include Fortinet, Depot, Tenable, Mayo Clinic, and various U.S. state government employees. The exposed emails could lead to phishing attacks and other malicious activities. The vulnerability remains unpatched, raising significant security concerns. Security professionals are urged to monitor for potential misuse of the exposed data. The incident highlights the risks associated with hardcoded credentials in production environments. 3 sources 66

Extracted Entities

ClickUp’s Hardcoded API Key Exposes 959 Emails from Fortune 500 Giants

The full story

Extracted Entities

Attack Types (1)

Companies (4)

CWE Weaknesses (2)

Industries (1)

Tools (1)