OVHcloud CLI Compromised: Hacker Injects Malicious Code, Exposing User Credentials and Access Keys

On October 19, 2026, a significant cybersecurity incident unfolded involving OVHcloud, a leading European cloud provider, when a hacker successfully infiltrated the company’s official online Command Line Interface (CLI) tool. The perpetrator gained unauthorized access through the GitHub account of an OVHcloud developer, subsequently injecting malicious code into multiple versions of the popular utility. This sophisticated supply chain attack has potentially exposed sensitive user data, including passwords and access keys, prompting an urgent call to action for all affected users.

The incident came to light swiftly on Monday, October 19, when users who had installed or updated the OVHcloud CLI were advised to consider their credentials compromised. Octave Klaba, founder and president of the Roubaix-based hoster, publicly confirmed the breach via a message posted on X (formerly Twitter). Klaba detailed that a hacker had compromised the version of the CLI uploaded to GitHub at 14:47 CET. The injected malicious program was designed to scour the local disk of affected machines, specifically targeting and exfiltrating "secrets"—critical identifiers that grant access to users’ servers and cloud services. This revelation sent immediate ripples through the developer and system administrator communities who rely heavily on such tools for managing their cloud infrastructure.

Understanding the Compromised Tool and Its Significance

The affected software is the official OVHcloud CLI, an essential utility for developers and system administrators. The CLI, short for Command Line Interface, allows users to manage their OVHcloud services by typing commands into a terminal, offering a powerful alternative to navigating the graphical user interface of the client area. This tool is instrumental in controlling various OVHcloud offerings, including dedicated servers, Virtual Private Servers (VPS), Public Cloud instances, and domain names. Its capabilities make it a cornerstone for automation scripts, which are frequently employed in complex IT environments for deploying and managing infrastructure at scale.

Given its pervasive use among technical professionals, the OVHcloud CLI’s open-source code is publicly available on the GitHub repository ovh/ovhcloud-cli. This open-source nature, while fostering transparency and community contributions, also presents a potential vector for attack if security protocols are not rigorously maintained. The primary user base for the CLI—developers and system administrators—are precisely the individuals whose machines are most likely to store a wealth of highly sensitive access credentials. These "secrets" often include API keys, SSH keys, database connection strings, and other tokens that provide programmatic access to critical cloud resources, making them incredibly valuable targets for cybercriminals.

Chronology of the Attack and Rapid Response

The attack unfolded with precision on October 19, 2026. The hacker’s initial point of entry was the GitHub account of an OVHcloud developer. While the exact method of gaining control over this account remains under investigation, it allowed the attacker to inject a malicious binary into the ovh/ovhcloud-cli repository. This rogue program was specifically engineered to harvest secrets stored on the local disk of any machine that installed or updated the compromised CLI versions.

The malicious code was deployed at 14:47 CET. The exposure window, during which the tainted versions were available for download, lasted for 1 hour and 34 minutes. OVHcloud detected and blocked the attack by 16:21 CET. This relatively short window, however, was sufficient for a number of users to download the compromised software. Crucially, the detection of the breach was not solely an internal OVHcloud initiative but was significantly aided by a vigilant customer.

According to a report by Cyberattaque.org, a user’s automated installation process failed due to a discrepancy in the SHA-256 checksum of the downloaded file. SHA-256 is a cryptographic hash function that generates a unique, fixed-size string of characters from a given input, acting as a digital fingerprint. When a file is modified, its SHA-256 hash changes. The customer’s system, designed to verify the integrity of downloaded files against expected checksums, flagged that the fingerprint for the new CLI version did not match the previously known, legitimate versions. This critical alert from a proactive customer directly led to OVHcloud’s rapid investigation and subsequent shutdown of the malicious versions. While not officially confirmed as the exact client Klaba thanked, the sequence of events strongly suggests this was the pivotal report.

The compromised versions of the CLI were identified as v0.11.0, v0.12.0, v0.13.0, v0.14.0, and v0.15.0. Fortunately, the v0.10.0 version remained unaffected, and OVHcloud swiftly released a clean v0.16.0 version to mitigate further exposure.

Implications and Risk Assessment

The implications of such a supply chain attack are profound, particularly for the targeted user base. Developers and system administrators often manage vast digital estates, and their machines typically house a multitude of highly privileged credentials. If these "secrets" fall into the wrong hands, the consequences can range from unauthorized access to cloud resources, leading to data breaches, to the hijacking of critical infrastructure, causing widespread service disruptions. The financial and reputational damage for affected organizations could be substantial.

A supply chain attack, like the one perpetrated against OVHcloud, is particularly insidious because it exploits the inherent trust users place in official software distributions. By compromising a legitimate channel (GitHub) and an official tool (OVHcloud CLI), attackers bypass traditional perimeter defenses and gain direct access to the endpoints of unsuspecting users. This method underscores a growing trend in cybercrime, where attackers target upstream vendors to reach a broader downstream victim pool, as seen in other high-profile incidents like SolarWinds or the more recent XZ Utils backdoor attempt.

The malicious binary’s ability to "fouille le disque" (search the disk) implies it was designed to locate common storage locations for credentials, such as .aws/credentials, .kube/config, SSH key directories (~/.ssh), and other configuration files used by various cloud services and development tools. The exfiltration of these keys could grant attackers full control over a user’s cloud accounts, including the ability to launch new instances, access sensitive data, modify network configurations, and even delete resources, creating a cascade of potential security incidents.

Official Guidance and Mitigation Steps for Affected Users

In response to the incident, Octave Klaba issued an unequivocal directive to all potentially affected users: act immediately. He urged users to either update their CLI to the latest secure version or, if uncertain, to completely remove the compromised tool. Following this, the most critical step is to change "all secrets" present on the affected disk. This is not a mere recommendation but a mandatory security measure to prevent further exploitation.

Here is a detailed breakdown of the recommended mitigation steps:

1. Stop Using Compromised CLI: Immediately cease using any version of the OVHcloud CLI downloaded or updated on October 19, 2026, between 14:47 and 16:21 CET.
2. Update or Reinstall the CLI:
   • If you had a compromised version, uninstall it completely.
   • Install the latest secure version (v0.16.0 or later) directly from the official OVHcloud GitHub repository or through verified distribution channels. Ensure the checksum matches the official one.
3. Revoke and Regenerate ALL Secrets: This is the most crucial step. Assume that any password, API key, SSH key, or other credential stored on a machine that ran the compromised CLI is now potentially compromised.
   • OVHcloud API Keys: Log into your OVHcloud client area and revoke all existing API keys. Generate new, strong API keys.
   • Other Cloud Provider Credentials: If you use other cloud services (AWS, Azure, Google Cloud, etc.) and store their credentials on the same machine, revoke and regenerate those as well.
   • SSH Keys: Generate new SSH key pairs and update them on all servers where the old keys were used for access.
   • Database Credentials: Change passwords for any databases whose credentials were stored locally on the compromised machine.
   • Version Control System (VCS) Tokens: If you stored GitHub, GitLab, or other VCS tokens locally, revoke and regenerate them.
   • Other Application Passwords: Any other application-specific passwords or tokens stored on the machine should be updated.
4. Scan for Further Compromise: Conduct a thorough security scan of the affected machine(s) to check for any persistent malware or unauthorized modifications beyond the CLI itself. Look for unusual network activity or new, unknown processes.
5. Enable Multi-Factor Authentication (MFA): For all critical accounts, especially those with cloud providers and development platforms, ensure MFA is enabled. This adds an extra layer of security, making it harder for attackers to use stolen credentials.

OVHcloud has not yet disclosed the exact number of users who downloaded the compromised versions. Klaba has committed to publishing more detailed information about the malicious binary "shortly," which is expected to provide further insights into its functionality and the extent of the data it sought to exfiltrate.

Broader Industry Context and Lessons Learned

This incident serves as a stark reminder of the ever-present dangers within the software supply chain and the critical importance of robust cybersecurity practices. For the industry, it highlights several key lessons:

• Developer Account Security: The compromise of a developer’s GitHub account underscores the necessity of stringent security measures for all accounts with elevated privileges, especially those used for code repositories. This includes mandatory multi-factor authentication (MFA), regular password rotations, and continuous monitoring for suspicious login activities or unauthorized commits.
• Code Integrity and Verification: The fact that a customer’s checksum verification caught the issue emphasizes the importance of cryptographic integrity checks. Organizations and individual users should integrate such verification into their deployment pipelines and update processes, rather than blindly trusting downloaded binaries.
• Proactive Threat Detection: While customer reporting is valuable, cloud providers and software vendors must also invest in sophisticated internal systems for real-time monitoring of their code repositories and build pipelines. Anomaly detection, static and dynamic code analysis, and integrity checks should be automated to catch malicious injections before they reach users.
• Incident Response and Communication: OVHcloud’s rapid public communication through its founder, Octave Klaba, is commendable. Timely and transparent communication during a breach is crucial for building trust and enabling users to take immediate protective actions. However, relying on a customer for initial detection points to potential areas for improvement in internal security monitoring.
• The "Zero Trust" Principle: This incident reinforces the "zero trust" security model, where no user, device, or application is inherently trusted, regardless of whether it’s inside or outside the network perimeter. Every access request must be authenticated and authorized. For users, this means exercising caution even with official tools and regularly reviewing and rotating credentials.

As OVHcloud continues its investigation into the specifics of the malicious binary and the method of account compromise, the incident serves as a critical case study in the evolving landscape of cyber threats. It underscores the shared responsibility between service providers and their users in maintaining a secure digital environment, demanding constant vigilance and proactive security measures from all parties involved. The swift action taken by OVHcloud and its users will hopefully mitigate the long-term impact, but the event will undoubtedly lead to enhanced security protocols across the industry.