Skip to content
Luanti's ContentDB Faces Major Security Breach

Luanti's ContentDB Faces Major Security Breach

First seen 27 Oct 2026, 13:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 27, 2026 at 15:19 UTC
  • •Unauthorized access to ContentDB's servers occurred from October 22 to 26.
  • •Two vulnerabilities were exploited, including one in a third-party component.
  • •Users are advised to take immediate action due to potential compromise of account information.

Luanti (formerly Minetest) reported a significant security incident involving its ContentDB system. An attacker exploited two vulnerabilities, including one in a third-party component, gaining unauthorized access to ContentDB's servers from October 22. The attacker accessed internal configurations, signed into a staff account, and potentially modified uploads. On October 26, the attacker achieved full access to run commands within a Docker container, allowing access to the database and uploads. Users are advised to take action as account information, including usernames, emails, and hashed passwords, may have been compromised. The breach was discovered on October 27, leading to ContentDB being taken offline and all secrets revoked. No evidence of malicious uploads has been confirmed, but the possibility remains.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-22
Unauthorized access began
An attacker exploited vulnerabilities to gain access to ContentDB's internal configuration and sign into a staff account.
Gamingonlinux
2026-10-26
Full access confirmed
The attacker gained full access to run commands on the server inside a Docker container, potentially accessing the database.
Gamingonlinux
2026-10-27
Breach discovery and response
The breach was discovered in the morning, leading to ContentDB being taken offline and secrets revoked.
Gamingonlinux

More articles in this cluster (2)

Following this threat?

Track ContentDB in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 4

Common questions

What data may have been compromised?
The attacker potentially accessed usernames, emails, and hashed passwords, along with uploads.
What actions should users take?
Users are advised to change their passwords and monitor accounts for suspicious activity.
Is there evidence of malicious uploads?
While no changes to uploads have been confirmed, the possibility of malicious uploads during the breach remains.