al-ice.ai

Default Password to Cluster Admin: Chainstack Traces ARTEX-Driven Breach Through Grafana and an Unauthenticated MCP Server

Agent & Supply Chain Security by al-ice.ai Editorial

On 12 November 2026, Web3 infrastructure provider Chainstack disclosed a late-October breach with an intrusion path this site’s readers will recognize part by part: the attacker entered through an internet-exposed Grafana instance in a development Kubernetes cluster where default administrator credentials had never been changed and no additional authentication stood in front of it, rode Grafana’s data-source proxy to internal services including an unauthenticated MCP server running with cluster-admin privileges, and — Chainstack assesses with high confidence — orchestrated the operation with ARTEX, the open-source framework that chains LLM agents into autonomous intrusions. Initial access landed 26 October, partial production access followed on 29 October, customer account databases were reached on 31 October — the same day Chainstack detected the intrusion and cut the paths — and the last observed use of a copied credential came 2 November. Exposed data includes customer organization names, account-holder names, member email addresses, and password hashes; systems holding node credentials were reachable and are being treated as exposed. Notably, Chainstack reports finding no exploited software vulnerability: the intrusion chained default credentials, missing authentication, excessive privilege, and long-lived credentials.

The MCP server was the hinge

The technically significant hop is the middle one. Grafana’s data-source proxy is designed to let the server reach back-end data stores on a user’s behalf; from a default-credential foothold, that proxy became a route into the cluster interior — and waiting there was a tool server speaking MCP with no authentication and cluster-admin rights. That is the nightmare composition this site has been documenting from the other direction all autumn: Grafana’s MCP surface returning SSH keys from a prompt argument and a version-confusion proof of concept treated the MCP server as the vulnerability; here the MCP server was healthy code with a missing lock on the door, and agentic tooling did the rest. ARTEX attribution rests on matching tooling, naming markers, and techniques seen across the broader AI-driven campaign wave — which, Chainstack stresses, characterizes the tradecraft, not the actor.

What was taken, and what customers must do

Past the foothold, the attacker read production secrets, used a compromised VPN key, and queried production databases. Customer nodes, the console, and the API were, according to the disclosure, not modified, and full payment-card numbers and security codes were never stored, so they were not exposed. But the credential guidance is unambiguous: Chainstack found no evidence node credentials were actually read, yet treats them as exposed and asks customers to rotate them, alongside changing passwords, regenerating platform API keys where applicable, and watching for phishing. The timeline discipline is worth noting — detection-to-cutoff on the same day (31 October), credential rotation, session invalidation, and privilege tightening afterward — even as the password-hash exposure keeps a long tail: hashes invite offline cracking attempts regardless of how fast the doors were re-locked.

What to actually do

  1. Authenticate every MCP server, especially inside the perimeter: an unauthenticated tool endpoint with cluster-admin is remote code execution with extra steps — bind MCP listeners to localhost or mTLS, and scope their service accounts to least privilege.
  2. Kill default credentials on observability and test instances first: Grafana, dev clusters, and staging dashboards are the Internet’s most-scanned login pages — rotate defaults at provisioning time and put SSO or client-cert gates in front.
  3. Audit data-source proxy reachability: any component that fetches internal URLs on behalf of a logged-in (or default-logged-in) user is a pivot primitive — restrict its egress to named back ends.
  4. Treat node and platform credentials as exposed on attacker-adjacent access: Chainstack’s posture — no evidence of read, rotate anyway — is the correct default when an agent framework has had days of database-adjacent access.
  5. Shorten long-lived credential lifetimes: the intrusion explicitly chained credentials that never expired — the blast radius of every future foothold shrinks with rotation and expiry.

Read with the AntiFox intrusions and GitGuardian’s 45-framework census, the ARTEX wave now has a confirmed enterprise-victim disclosure with full kill-chain detail to sit beside the telemetry. And next to the Fireworks second breach — dev-machine access via a cloud provider incident — the lesson compounds: in late 2026, production data keeps falling through development-adjacent doors its owners forgot existed, and agentic frameworks are purpose-built to find every one of them.

Our verification was read-only, and attribution here follows the site’s carried-as-reported convention: Chainstack’s disclosure was verified through two independent secondary reports read first-hand in full — Crypto Economy (Nicholet R., 12 November 2026) and TechFlow (12 November 2026) — which agree on the Grafana default-credential entry point, the unauthenticated cluster-admin MCP server pivot, the high-confidence ARTEX assessment with actor explicitly unidentified, the 26/29/31 October and 2 November timeline, the exposed data classes, the no-exploited-vulnerability finding, the unmodified nodes/console/API, the no-evidence-but-rotate node-credential posture, and the customer guidance. We did not directly retrieve Chainstack’s official incident report, touched no Chainstack infrastructure, ran no ARTEX code, and contacted no vendor. Brave Search was used for discovery only.

Sources: