Chainstack Breach: Default Grafana Password Exposed Customer Data

Blockchain infrastructure provider Chainstack disclosed on Nov. 10 that an attacker reached its production systems through a Grafana test instance left on its default administrator password, exposing a database of customer names, email addresses and password hashes. The intrusion route ran through an unauthenticated Model Context Protocol (MCP) server holding Kubernetes cluster-admin privileges — the highest permission tier in the cluster.

The company's security update reconstructed the attack path in unusual detail. The attacker first entered Chainstack's internal network via the Grafana test instance, which retained the vendor's default administrator credentials. From that foothold, the intruder used an MCP tool server — a component that lets AI agents connect to external tools and data — to extend access into production environments.

Chainstack attributed the breach to three compounding failures: a default password on the test instance, missing authentication on the MCP server, and excessive Kubernetes privileges attached to that server. Any one of the three controls, functioning as intended, would likely have interrupted the chain. The update also identified ARTEX, an AI attack framework, as part of the intrusion.

What data was actually taken?

The attacker accessed a database containing customer names, email addresses and password hashes. Some production-system credentials were also obtained. Chainstack did not specify the number of affected customers, the date the intrusion began, or how long the attacker held access — omissions that matter when assessing exposure.

Password hashes are not plaintext passwords, but their value depends entirely on the hashing algorithm and whether the hashes were salted. Chainstack's disclosure does not say. A weakly hashed credential can be cracked offline within hours; a modern bcrypt or argon2 hash can resist years of computation.

What must customers do now?

Chainstack asked all customers to take three actions:

• Change their account passwords
• Rotate node credentials
• Regenerate API keys

Node credential rotation deserves particular attention. Compromised node access keys can allow an attacker to read blockchain data streams or route transactions through a customer's infrastructure, with consequences that extend well beyond the account itself.

Why does an MCP server widen the attack surface?

Model Context Protocol is a standard that lets AI agents connect to external tools and data sources. Its adoption has grown quickly, but Chainstack's disclosure illustrates the operational risk: an MCP server with cluster-admin privileges and no authentication becomes a bridge from any compromised internal host to the entire production cluster.

The lesson is not specific to Chainstack. A single misconfigured tool server, granted sweeping privileges for convenience, can nullify every other access control in the environment. Least-privilege scoping for automation endpoints remains the exception rather than the rule across the industry.

Chainstack has not disclosed whether it has completed remediation of the three identified control gaps, nor whether regulators or law enforcement have been engaged. Customers who operate Chainstack nodes should treat credential rotation as immediate rather than optional, and should verify, after rotation, that no unrecognized API keys remain active on their accounts.