Cybernews ClickUp API Key Vulnerability Exposes 959 Emails from Fortune 500 Firms
Article Content
- •959 email addresses from Fortune 500 firms and government agencies were exposed.
- •The vulnerability stems from a hardcoded API key in ClickUp's JavaScript bundle.
- •The issue was first reported in January 2025 and remains unaddressed as of April 2026.
A security vulnerability in ClickUp has led to the exposure of 959 email addresses associated with major Fortune 500 companies and government agencies. The issue arises from a hardcoded Split.io SDK token in ClickUp’s production JavaScript bundle, which is automatically loaded when users access the platform. This vulnerability was first reported in January 2025 and has not been addressed as of April 2026. Affected organizations include Fortinet, Depot, Tenable, Mayo Clinic, and various U.S. state government employees. The exposed emails could lead to phishing attacks and other malicious activities. The vulnerability remains unpatched, raising significant security concerns. Security professionals are urged to monitor for potential misuse of the exposed data. The incident highlights the risks associated with hardcoded credentials in production environments.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Akin Gump in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include… 
Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…