AN OVHcloud supply-chain incident involved an attacker swapping release binaries for the OVHcloud CLI on GitHub with a modified build that exfiltrates secrets from disk. The attack surfaced when a customer’s pipeline failed a SHA-256 checksum check, revealing the binary had been tampered with. OVHcloud later said it blocked the malicious release within 94 minutes. The compromise did not involve a new CLI version; instead, older releases were replaced.
The window of changes was about 12:47–13:12 UTC on 19 October 2026, and the affected range is described as v0.11.0 through v0.15.0. Versions v0.10.0 and the forthcoming v0.16.0 were reported as clean.
Infection and impact details indicate that users who installed one of the affected releases ran the swapped binary as if it were the legitimate CLI, enabling the secret-stealing function. The entry point was attributed to a GitHub account compromise belonging to a developer, who added a binary designed to retrieve secrets from disk; OVHcloud has not yet disclosed where the exfiltrated data is sent, and attribution remains unconfirmed. OVHcloud is still analysing the binary and intends to publish further details.
Practical response guidance from the vendor and third-party observers emphasises acting promptly to rotate any secrets, keys, and credentials on affected machines, ensure releases come from locked-down pipelines, pin checksums for third-party binaries, and consider building Go tools from the module proxy rather than using prebuilt release files. The incident underscores how a hijacked developer account can poison a trusted tool, though a properly pinned checksum reportedly prevented broader damage in this case.