CVE Tools
Track your stack
Double Counter Rotated Its Bot Token Mid-Breach. The Attacker Read the New One in Two Minutes.. A Discord anti-alt bot's "retired" server was still running Metabase, publicly reachable. The entry poin

Double Counter Rotated Its Bot Token Mid-Breach. The Attacker Read the New One in Two Minutes.

A Discord anti-alt bot's "retired" server was still running Metabase, publicly reachable. The entry point matches a CVSS 10.0, KEV-listed bug — but the real failure was that one stolen credential unlocked three separate ways back in.

CVE Tools5 min read

CVE-2026-72898In CISA KEVEPSS today 99%, 99th percentileCVSS 10.0Open the record

Double Counter, a Discord anti-alt-account bot used in more than 600,000 servers, was breached on October 4, 2026 — not through its production stack, but through an OVH server its operator, Tellter SAS, thought was already dead. Our read: the technical entry point almost certainly matches CVE-2026-72898, a CVSS 10.0 Metabase bug already on CISA's KEV list, but that's a side issue. The real story is that one compromised host handed the attacker three independent sets of cloud credentials, so revoking any one of them — including the bot's own Discord token, twice — did nothing. That's the part worth taking into your own environment.

5h51mAttacker dwell time in Tellter's cloud12:03–17:55 UTC, Oct 4
2 minTime to read the rotated bot tokenfrom inside a still-compromised container
~28MDiscord IDs/usernames in Tellter's exposure estimateupper bound, not a confirmed leak count
274.9KEmail addresses actually confirmed publishedper Have I Been Pwned, added Oct 7
CVE-2026-72898Metabase SQL injection via password reset endpointEPSS 99%CVSS 10.0

The server that wasn't actually retired

Per Tellter's incident report, the attack didn't start against Double Counter's live infrastructure at all. It started against a leftover OVH server from a previous hosting setup — disconnected from the running service, but never actually taken off the internet. That box was still running a self-hosted Metabase instance, publicly reachable, with stored credentials nobody had rotated since the migration: an admin-rights cloud service-account key, and a saved administrator CLI session.

How the six hours went

INC-2026-10-04, per Tellter's own report (all times UTC)

  1. Reconnaissance begins
    Attacker probes the legacy OVH server and an internal API from rotating VPN addresses, trying usernames like root, nathan, debian, analytics-sync, metabase.
  2. Legacy server compromised
    Admin session forged on the exposed Metabase instance; attacker reaches the host.
  3. First cloud access
    Attacker uses the stolen cloud service-account key to enter Tellter's production Google Cloud project.
  4. Persistence + first export
    An SSH key is added; a ~5.0 GB database export is created in a storage bucket but never actually downloaded.
  5. Bot token stolen
    Attacker opens a shell inside a running Double Counter bot container and reads the live Discord bot token.
  6. Support server hijacked
    Using the bot's identity, attacker grants itself admin and ~15 roles, gets banned by staff, un-bans itself via the bot, then starts posting invite spam into roughly 50 large Discord communities.
  7. First token rotation
    Responders invalidate the stolen bot token — their first containment move.
  8. Replacement token read
    The attacker reads the newly-issued token within about two minutes of its deployment, straight out of a container that was never actually cleaned.
  9. Real exfiltration window
    Backups deleted, database password changed, and roughly 12 GB of tables actually copied out — distinct from the earlier, undownloaded 5 GB export.
  10. Service-account key revoked, attacker falls back
    Responders kill the cloud key and the SSH key; attacker pivots to the still-live saved admin CLI session instead.
  11. Payment fraud via a separate product
    A payment key for an unrelated Tellter product ("Atis") is abused for 23 attempted charges totaling $7,331; 17 are declined. The key is revoked at 17:14.
  12. Full containment
    All admin sessions finally revoked — the third and last credential path closed.
  13. Service restored
    Double Counter comes back online on entirely new credentials.

Why rotating the token didn't end it

Tellter's responders did the textbook first move — they killed the leaked bot token at 13:39. It didn't matter, because the token was never the actual foothold. The attacker had three separate, independently-usable credentials that all traced back to the one compromised legacy host: the cloud service-account key, an SSH key it planted, and a pre-existing saved admin CLI session. Revoking the bot token closed none of them; revoking the service-account key (15:17) and the SSH key still left the admin session standing. Only killing all three, at 17:55, actually ended it.

What got rotated vs. what actually stopped the attacker

Rotated / revoked, one at a time
  • Bot/Discord token (13:39) — re-read from a container in ~2 minutes
  • Cloud service-account key (~15:17)
  • Planted SSH key (~15:17–16:46)
What finally closed the door
  • All admin CLI sessions revoked (17:55)
  • Database closed off from the public internet
  • Cache database moved to a private network
  • No long-lived service-account key left in the project at all

What was actually exposed — and the gap between estimate and confirmed

Tellter's figures are deliberately conservative upper bounds — "what could have left," in the company's own framing — not a count of data known to be circulating. It's worth keeping those two numbers separate.

Data categoryTellter's exposure estimateIndependently confirmed
Discord IDs / usernames≈28 million accountsNot independently re-counted
IP addresses + coarse location≈27 million accountsNot independently re-counted
User-agent hashes≈25 million accounts (fully copied)—
Email addresses≈1.0 million accounts274.9K published, per Have I Been Pwned (added Oct 7, 2026)
Payment-customer records≈5,000 customersA subset partially published
Passwords / card numbersNot collected by the botNone exposed

The CVE, and the KEV timing that matters

CVE-2026-72898 is an unauthenticated SQL injection in Metabase's password-reset endpoint (CWE-89), scored CVSS 3.1 10.0 — the ceiling. Our data shows EPSS at 98.6%, 99.9th percentile: essentially guaranteed to be under active mass exploitation. It's CISA KEV-listed, first exploited as a zero-day around early August 2026 and patched in Metabase 0.58.24+ (and the equivalent later release lines). Per the vendor's own advisory, the bug works by injecting a crafted request into /api/session/reset_password that forges a session row in the core_session table tied to user_id = 1 — the first admin account created during setup — with no token, no login, no authentication at all.

CVE-2026-72898 is far from an isolated incident this year — track what else has landed on CISA's KEV catalog recently on our trends page.

What this is actually a lesson in

  1. Decommissioning means killing network reachability AND rotating every credential that host ever held — not just stopping it from serving the app it was built for.
  2. A stolen token is a symptom, not the root cause. If the same host also yields an SSH key or a cloud service-account key, rotating the token buys you nothing.
  3. Treat a saved CLI session the same way you'd treat a stored password: it's a standing credential, and it should expire on its own even if nobody ever steals the host it lives on.
  4. Audit any Metabase instance you still run — self-hosted or not — against CVE-2026-72898 specifically. The vendor's own detection guidance is to check the core_session table for admin sessions that were never preceded by a real login.
  5. Scope service accounts narrowly. An admin-rights key sitting on an unmonitored legacy box is a loaded gun; a narrowly-scoped one limits exactly how much a forgotten server can cost you.
Vendor-sourced detection guidance for CVE-2026-72898 · Anomalous admin session in core_sessionGitHub

No public Sigma/Suricata/Nuclei rule is tracked for this CVE in our index as of writing. The one concrete indicator comes from Metabase's own advisory — use it, don't skip detection because nobody's published a signature yet.

Session-forgery exploitation of CVE-2026-72898: an administrator session in the application database with no corresponding prior login event. Direct read access to the Metabase application database's core_session table.
github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
Metabase GitHub Security Advisory GHSA-vwf4-m7j8-wcjf

CVSS/EPSS/KEV data as of 2026-10-26

Sources: Metabase Security Advisory GHSA-vwf4-m7j8-wcjf · CVE-2026-72898 record, CVE.org · CISA Known Exploited Vulnerabilities Catalog · Have I Been Pwned: Double Counter