Blacksmith says an unauthorised party accessed its CI job-log store; job-log data of about 2.6% of customer accounts affected, CI execution not affected
CI runner provider Blacksmith says that on 5 November 2026 its security team detected and contained unauthorized access to the system that stores the console output (job logs) of CI jobs run on Blacksmith runners.
According to the company's status-page notice (posted 6 Nov 2026, 20:35 UTC), the access was revoked the same day, a later attempt by the same party to regain access was blocked, and at this time there is no evidence that customer exposure goes beyond the job-log store.
The company says CI execution was not affected and that the incident impacted job-log data belonging to approximately 2.6% of customer accounts; it has contacted each of those customers directly and does not believe any other customer needs to take action.
Blacksmith says its investigation is ongoing and it will publish a full report when that work is complete. The notice does not say what data the affected job logs held or name the party. (source: Blacksmith status page)
- Product
- Blacksmith CI runners — job-log (console output) store
- Versions
- n/a — incident
- Exploited in Australia?
- unknown
- Patch to
- Desk advice (not company text): Blacksmith customers should check for a direct notice from the company; CI logs can hold secrets printed by build steps, so teams that were notified should rotate any credentials that appeared in job output and mask secrets in logs.