The Luanti project says an attacker gained unauthorised access to ContentDB's servers and data, including emails, hashed passwords and uploads, in a notice titled 'URGENT: ContentDB security incident: 22–26 October 2026' on the Luanti blog (web address dated 27 October 2026).

Luanti says the attacker broke in by exploiting two vulnerabilities, one in a third-party component that it has reported to the maintainer. In UTC: from 22 October 13:00 the attacker had access to ContentDB's internal configuration and used it to sign into a staff account (the configuration also allowed modifying uploads and sending emails, but Luanti has no evidence this took place); a patch for one of the vulnerabilities was coincidentally deployed on 22 October at 17:35; from 24 October 23:00 the attacker probed for remote code execution; from 26 October 00:15 the attacker had full access to run commands on the server inside a docker container; and on 26 October at 09:00 Luanti discovered the break-in, took ContentDB offline and revoked all secrets, including sessions, API tokens and GitHub OAuth tokens.

Luanti says the attacker had full access to the secrets, database, redis and uploads: usernames, emails and passwords stored as salted bcrypt hashes; IP addresses, not linked to any account, of people who downloaded or viewed packages in-game in the two weeks before 26 October; and uploaded packages and release files. With the secret key the attacker could act on behalf of any account.

Luanti says it checked every upload against backups and found no changes, but has not ruled out that ContentDB served malicious uploads during the vulnerable period. ContentDB will stay offline for security updates, likely for a week or more.