Grafana Labs data breach stems from missed token rotation after TanStack supply‑chain attack

On 20 May 2026, Grafana Labs announced that a data breach had occurred when a single GitHub workflow token slipped through its rotation process. The breach was triggered by the TanStack npm supply‑chain attack, in which a malicious package containing credential‑stealing code was pulled by Grafana’s continuous‑integration/continuous‑deployment (CI/CD) pipeline. When the package was executed in the GitHub environment, it exfiltrated workflow tokens to attackers. Although Grafana immediately rotated the majority of its tokens, one remained active, giving the intruder access to private repositories and exposing operational information such as business contact names and email addresses. The company confirmed that no customer production data was compromised, the codebase remained unchanged, and no production systems were affected, so users are not required to take action at this time. Grafana pledged to notify impacted customers if new evidence emerges.

The incident highlights the vulnerability of supply‑chain attacks and the critical importance of rigorous token management. The TanStack package, originally distributed through npm, was designed to harvest credentials and had already been identified as a threat vector in early May. Grafana’s CI/CD workflow, which automatically pulls dependencies, inadvertently executed the malicious code, demonstrating how even well‑intentioned automation can become a conduit for attackers if proper safeguards are not in place. The missed token rotation—an oversight in Grafana’s security protocol—allowed the attacker to maintain a foothold within the organization’s private repositories, underscoring the need for automated, fail‑safe rotation mechanisms.

Reactions from the security community have been largely cautionary. Experts emphasize that the breach serves as a reminder that supply‑chain security must be treated as a first‑line defense, not a secondary concern. Grafana’s swift notification and the absence of customer data loss are seen as mitigating factors, but the exposure of internal contact details raises concerns about potential phishing or social‑engineering attacks. The company has announced plans to review its token rotation policies and to implement additional monitoring of third‑party packages. Industry analysts predict that similar incidents will prompt broader adoption of automated dependency scanning and stricter CI/CD pipeline controls across the software development ecosystem.