Kernel discloses leaked API key led to logging provider and GPU server access

What happened

Kernel discloses, in a public notice dated November 4, 2026, a security incident that it says it detected on November 2, 2026 Kernel. This advisory relies only on Kernel’s own account. No independent outlet or third party has verified it.

According to Kernel:

• On October 24, an unauthorized party used a compromised Kernel API key to probe for access. Kernel’s timeline says the key was used to “read data across internal profiles” Kernel.
• On October 27, the same party used the compromised key to gain access to a staff login at Kernel’s logging provider. Kernel says the party accessed and downloaded data there, and that this data contained “a small number of kernel API keys and app deployments’ third-party secrets” Kernel.
• On November 3, 2026, Kernel says the same party used a compromised credential for its hosting provider account to access 4 GPU-enabled servers. Kernel says 3 of those servers ran Kernel browser sessions and 1 (a development server) held no customer data. The timeline records a cryptominer being started or attempted on the servers Kernel.
• Kernel says the incident affected 0.28% of its customers Kernel.

Kernel says it revoked the compromised credentials, removed the party’s access to the logging provider, blocked the IP addresses involved, took the affected servers offline, rotated all credentials those servers could access, and audited for unauthorized access across its systems. It says it has notified the organizations whose data was exposed and given them remediation guidance Kernel.

Kernel says its evidence suggests the attacker or attackers were financially motivated and part of a larger cryptomining campaign. It also says it believes they use an AI-assisted pentesting platform called ARTEX as a command center. These are Kernel’s assessments and have not been independently confirmed Kernel.

The following details are not confirmed:

• How the original API key leaked.
• How the hosting provider credential was compromised.
• The names of the logging and hosting providers.
• Whether any data from the browser sessions on the affected servers was accessed.

Am I affected?

• Notified customers: Kernel says it has notified the organizations whose data was exposed. If you received that notice, treat your Kernel API keys and deployment secrets as exposed Kernel.
• Customers with no notice: Kernel puts the impact at 0.28% of customers. It does not say which secret types or providers were in the downloaded logs beyond “third-party secrets”. Which specific customers are affected is not confirmed publicly.
• CVEs: No CVE or software vulnerability is described. This is an operational credential incident, so there is no product version to upgrade.

What to do now

1. Check for a notice from Kernel and follow the remediation guidance it gives you. If you are unsure, contact support@kernel.sh, the address Kernel lists for more details Kernel.
2. As a precaution, rotate your Kernel API keys. Kernel says it is increasing adoption of scoped API keys, so where available, replace broad keys with scoped ones Kernel.
3. Rotate any third-party secrets you pass to Kernel app deployments, such as tokens or credentials for other services. Then review those services’ access logs from October 24, 2026 onward for unexpected use.
4. If you want to hunt for related activity, request the attacker’s technical fingerprint, which Kernel offers through security@kernel.sh Kernel.

Sources

• Kernel: November 4, 2026 Public Notice of Security Incident