CrowdSec confirms source code leak from Tanstack breach
On September 16, 2026, security vendor CrowdSec said it had been informed of a leak of its GitHub source code, which its team verified and traced back to May 2026. CrowdSec's source splits into a public part, the Security Engine, which is open source by design and therefore out of scope, and a private part covering its SaaS console, some AWS Cloud routines, connectors and automations. CrowdSec said a news report's figure of 300 different repositories is accurate once the 130-plus public repositories are counted in, though it called that number a reflection of how the code is subdivided rather than a meaningful volume figure. It also denied that any "other file contained" or "internal development material" beyond what sits in those repositories was involved.
CrowdSec said no client data, login credentials, names, organization details or anything else belonging to customers was leaked, and that it does not store personally identifiable information or client logs, so the impact is confined to CrowdSec itself. Its team searched for tokens or credentials that could enable lateral movement into other systems and said it found none. The company argued the leaked private code, while valuable, cannot seriously harm it, since its edge comes from network effect and scale rather than code alone, and it noted the SaaS source is audited regularly and has evolved significantly in the four months since the leak.
CrowdSec attributed the likely leak vector to the same Tanstack supply-chain compromise it says also hit Mistral AI: a Tanstack component used inside its organization in May 2026 appears to have been backdoored to extract an API key authorized to read the private codebase. The exposure window was a short timeframe within May 2026, and CrowdSec said it has since rotated all required tokens and credentials. It thanked Fuites Infos for reporting the issue.
Key facts
- CrowdSec confirmed on September 16, 2026 that its GitHub source code leaked in a breach dating to May 2026, pointing to a backdoored Tanstack component as the likely vector.
- The leak spans about 300 repositories once the 130-plus public open source ones are included; the private portion covers the SaaS console, some AWS Cloud routines, connectors and automations.
- CrowdSec says no client data, login credentials, names, organizations or other customer information was exposed, and its team found no tokens usable for lateral movement.
- The compromised component extracted an API key with read access to the private codebase; the exposure window was a short timeframe in May 2026, and CrowdSec has since rotated the affected tokens and credentials.
- CrowdSec thanks Fuites Infos for reporting the leak and links the vector to the same Tanstack supply-chain compromise it says also affected Mistral AI.
Why it matters
A security vendor having its own private source leaked is a reputational and operational test in its own right, and this one sits inside a wider pattern: CrowdSec names the same Tanstack supply-chain compromise as the vector behind an earlier leak at Mistral AI, which points to a shared dependency risk rather than an isolated incident at one company.
Who it affects
Directly, CrowdSec and its private GitHub repositories; the public Security Engine code is unaffected since it was already open source. CrowdSec says the impact does not extend to its customers, since it states no client data, credentials or logs were part of the leak; anyone running the same or a similar Tanstack component in their CI/CD pipeline is the wider group with reason to check their own exposure.
How to use it
For teams running CI/CD pipelines with third-party components like Tanstack, the practical takeaway is to review which tokens those components can read, and to rotate CI/CD credentials on any hint of a supply-chain compromise rather than waiting for a public disclosure, as CrowdSec says it did once it identified the backdoored component.
How solid is it
The account comes entirely from CrowdSec's own statement; the company says it verified the report and investigated internally, but there is no independent confirmation cited for the no-client-data finding or for the Tanstack attribution beyond CrowdSec's own account, and the leak itself surfaced publicly four months after it is said to have occurred.
Risks and caveats
CrowdSec downplays the practical danger of the leaked private code, arguing its value depends on network effect rather than code alone, but the statement does not give a breakdown of how many of the roughly 300 repositories are private versus the 130-plus public ones, nor an exact date for when the Tanstack compromise itself took place, only that the component was in use in May 2026.
“The leak was only exploitable during a short timeframe in May 2026.”
— CrowdSec