GitBook breach: SSO flaw led to infrastructure access, API tokens revoked

What happened

GitBook says that on 2 November 2026 an attacker used a flaw in its SSO login flow to create login sessions acting as GitBook staff. From there the attacker queried the authentication information of a misconfigured GitHub App installed in GitBook’s organization, which gave access to internal code repositories and eventually a Cloudflare API key. That key led to production secrets granting full infrastructure access through a service account (GitBook).

GitBook disabled the affected service accounts, which stopped the attack and took the app offline from 20:32 UTC on 2 November to 11:56 UTC on 3 November, about 16 hours. Cached published sites stayed up for part of that window. GitBook says it rotated every secret in its production infrastructure and every GitBook-managed customer secret, and invalidated all API tokens issued before its cutoff (GitBook).

According to GitBook, the attack targeted one customer. GitBook found no evidence that any other customer’s content was modified. However, the attacker could reach customer data during about 2 hours 45 minutes on the evening of 2 November and about 40 minutes early on 3 November, so GitBook treats all customer data as exposed. Accessible data included GitBook API tokens, integration tokens and secrets, session signing secrets, and questions site visitors asked GitBook Assistant. GitBook says billing information, passwords and IP addresses were not compromised (GitBook).

GitBook describes the incident as a “sophisticated, highly targeted attack using AI agents” and says the speed and precision pointed to automation and AI (GitBook). Decrypt noted that, at the time of its report, GitBook had not explained how the attacker used these tools, which AI systems were involved, or how the credentials were obtained, and that the disclosure did not establish that GitBook’s own AI products were responsible (Decrypt). GitBook’s later post mortem describes the access path but does not name any AI system. Which AI systems were used is not confirmed.

The reported timing differs between GitBook’s updates. Its 3 November notice, also reported by Decrypt, said the attacker gained access to infrastructure credentials at 19:00 CET on 2 November (Decrypt). The post mortem timeline begins earlier: first hijacked account at the targeted customer at 12:27 UTC, staff sessions at 16:32 UTC and production access at 17:48 UTC (GitBook).

Decrypt reported that PancakeSwap took its documentation offline as a precaution, said its docs and app were not compromised, and then moved its documentation from GitBook to infrastructure under its own control (Decrypt).

Am I affected?

• GitBook API users: yes. GitBook revoked all personal API tokens, so existing apps need new tokens (GitBook).
• Third-party tools connected to GitBook, and published integrations that use secrets: GitBook asks you to rotate those secrets (GitBook).
• Git Sync (GitHub app) and GitLab: GitBook says it rotated these keys and no action is needed. However, the attacker could act as the GitBook app in the repositories or projects each customer had granted access to, and GitBook cannot determine whether any action was taken there (GitBook).
• Documentation sites using authenticated access with a custom backend: affected. Session signing secrets were accessible (GitBook).
• GitBook MCP server users: GitBook’s 3 November update asks you to re-authenticate (GitBook).

What to do now

1. Create a new GitBook API token and update any apps that use it (GitBook).
2. Rotate any third-party API tokens or secrets you use to connect other tools to GitBook (GitBook).
3. If you have published integrations that use secrets, rotate those secrets (GitBook).
4. If you use authenticated access with a custom backend, regenerate the authenticated access signing key in the GitBook app and update it in your backend (GitBook).
5. If you use the GitBook MCP server, re-authenticate it (GitBook).
6. Search your environments, including repositories connected to GitBook, for these IP addresses that GitBook links to the attack: 94.183.188.91, 45.139.84.195, 198.251.83.217 (GitBook).
7. If you are unsure what applies to you, contact your GitBook account manager or support team, as GitBook advises (GitBook).

Update, 9 November 2026

• Decrypt reports that by Tuesday afternoon GitBook said its application, API and published documentation were accessible again, although some services could remain degraded during recovery. (decrypt.co)
• Decrypt reports that GitBook said it detected the intrusion immediately and moved to contain it. (decrypt.co)

Sources

• GitBook: Security incident, November 2026
• Decrypt: Crypto Docs Host GitBook Hit by AI Agent Security Breach, Urges Users to Rotate Keys