Skip to content
OVHcloud CLI Supply Chain Attack Compromises Multiple Releases

OVHcloud CLI Supply Chain Attack Compromises Multiple Releases

First seen 20 Oct 2026, 10:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 12:20 UTC
  • •Five versions of OVHcloud CLI were compromised in a supply chain attack.
  • •Malicious binaries were available for 94 minutes before being removed.
  • •Users are advised to change secrets if they installed during the attack window.

On October 19, 2026, OVHcloud reported a supply chain attack where an attacker hijacked a developer's GitHub account to replace five releases of the OVHcloud CLI with malicious binaries designed to steal secrets from users' disks. The compromised versions, v0.11.0 to v0.15.0, were available for approximately 94 minutes before being removed. Users who installed or updated the CLI during this window on macOS, Linux, or Windows could have been affected, while those using Homebrew or building from source were not at risk. OVHcloud has since published a clean version, v0.16.0, and is advising affected users to change their secrets. The attack highlights vulnerabilities in software supply chain security and the importance of stringent build pipeline controls.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-19
Supply chain attack reported
OVHcloud confirmed that a developer's GitHub account was hijacked, leading to the release of malicious binaries.
Thestack.Technology
2026-10-19
Compromised versions identified
Versions v0.11.0 to v0.15.0 of the OVHcloud CLI were identified as compromised and removed within 94 minutes.
Thehackernews
2026-10-19
Clean version released
OVHcloud released a clean version v0.16.0 of the CLI to replace the compromised versions.
Thehackernews

More articles in this cluster (4)

Following this threat?

Track Glassworm and OVHcloud in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 3

Common questions

Which versions of OVHcloud CLI are affected?
Versions v0.11.0 to v0.15.0 are affected; v0.10.0 and v0.16.0 are clean.
What should I do if I installed an affected version?
If you installed during the attack window, change all secrets stored on your disk immediately.
How long was the malicious version available?
The malicious binaries were available for approximately 94 minutes.