Chainstack asks customers to rotate node credentials and regenerate API keys

How the access controls failed

Entry path: a development Grafana instance with default administrator credentials, an unauthenticated tool server with broad Kubernetes permissions, and machine credentials linking development and production environments. Lesson: post-login reach determines impact. Low-profile testing services become consequential if they can contact sensitive systems or hold extended privileges. Related context: NewsBTC’s coverage of the NEAR AI infrastructure incident shows how surrounding infrastructure shapes a crypto platform’s security.

What customers are being asked to address

Potential exposure: account names, organisation details, email addresses, password hashes. Node credentials are treated as exposed. Requested actions: change passwords, rotate node credentials, regenerate platform API keys where used. Distinction: password hashes represent passwords, active tokens can authorize requests. Replacing a login password does not invalidate every other credential. Incident guidance must specify which credential types are affected to avoid ambiguity for application endpoints, automated jobs, and service integrations.

Credential rotation has a completion step

Chainstack’s node-management documentation: rotation is staged. New credentials are generated while existing ones remain active. Applications move to the new set before old credentials are deactivated. Both sets continue to work until manual deactivation with no automatic time limit. Node rotation does not change a multichain authentication token. Benefit: lower risk of service interruption during updates. Required follow-up: finish the migration and disable the old credentials. Maintain a completion record that shows which applications moved and when deactivation occurred.

The underlying design problem is familiar

Grafana’s security guidance notes that local network services may be reachable through its data-source proxy. Controls: restrict permitted destinations and use firewall rules to block access to sensitive internal services. Security layers do different jobs: authentication, network boundaries, and permission limits each constrain blast radius if another layer fails. NewsBTC’s report on Chainalysis restoring screening services illustrates how operational recovery and exposure analysis can proceed on different timelines.

Chainstack’s expanded account provides more detail for assessment. The remaining test: verify completion of access changes and confirm revised controls prevent a compromised service from reaching beyond its intended role.

written by the News Desk and edited by Samuel Rae.