Botpress Discloses Internal Breach and Customer Credential Risk

What happened

On November 6, 2026, Botpress announced that an attacker exploited a flaw in its internal authentication system and used an employee's API credential to access bot configurations in 16 customer workspaces. The breach occurred between October 13 and October 21, 2026, allowing the intruder to read configurations that may have contained third-party credentials. The attacker also changed integration settings in two additional customer workspaces. Botpress fixed the vulnerability and revoked the compromised credentials on October 21, 2026, and has contacted affected customers.

Key details

• 16 customer workspaces had bot configurations accessed by the attacker.
• Integration settings were altered in 2 other customer workspaces.
• The breach began with probing on October 12, 2026, and active access lasted from October 13 to October 21, 2026.
• Botpress cannot confirm which specific credentials were valid and exposed at the time of access.
• No ransom demand was made, and there is no evidence that customer data was published or sold.

Why it matters

Customers whose workspaces were accessed may need to replace all credentials stored in their bots, as Botpress cannot determine exactly which secrets were exposed. Botpress is still rotating internal credentials and reviewing staff access policies, which means some remediation steps are ongoing. Organizations using Botpress must assess their risk and update any third-party credentials that could have been accessed during the incident.