Critical Zapier Vulnerability (CVE-2023-XXXX) Allows Account Takeover

Key Takeaways

• A critical exploit chain dubbed “Zapocalypse” was discovered in Zapier, potentially leading to platform-wide account takeovers.
• The attack leveraged a low-privilege code execution feature within “Code by Zapier” and chained multiple misconfigurations to escalate privileges.
• The vulnerability did not stem from a single zero-day but a combination of issues including credential recovery from memory, misconfigured IAM roles, and leaked NPM tokens in container metadata.
• Zapier has acknowledged and fully remediated the identified issues, with fixes implemented between February and March 2026.

A sophisticated attack chain, dubbed “Zapocalypse,” has been uncovered within the Zapier platform, demonstrating a critical vulnerability that could have facilitated extensive account takeovers. The exploit originated from a seemingly low-privilege code execution function, which researchers were able to weaponize into a potent supply-chain attack path.

Token Security confirmed that its researcher will detail the Zapocalypse exploit chain, specifically targeting Zapier users, at the upcoming fwd:cloudsec North America conference on June 1, 2026.

The Zapocalypse Attack Chain Unveiled

The investigation into the Zapocalypse attack revealed a multi-stage process that began with the execution of Python code within Zapier’s “Code by Zapier” feature, hosted in an AWS Lambda environment. Researchers quickly established a foothold, enabling them to execute operating system commands and inspect the runtime. Crucially, they observed that the function had previously processed AWS session credentials, even though these values were subsequently scrubbed from environment variables.

The core of the vulnerability was not a singular, previously unknown flaw, but rather a sequence of interconnected weaknesses. The initial step involved sandbox reconnaissance, where the team confirmed the feasibility of OS-level command execution within the Lambda environment using os.system.

Following this, the researchers successfully recovered “orphaned” STS credentials from the process memory using /proc/self/mem. This technique bypassed standard cleanup procedures, which merely remove references to environment variables without necessarily erasing the underlying data from memory.

This critical step facilitated lateral movement within Zapier’s infrastructure. Despite being named allow_nothing_role, a misconfigured IAM role provided sufficient access to the Elastic Container Registry (ECR), allowing researchers to enumerate repositories and extract container data, including DescribeRepositories, ListImages, BatchGetImage, and GetDownloadUrlForLayer permissions.

Further investigation revealed a high-privilege NPM publish token embedded within container build metadata, specifically in ARG/ENV history, rather than on the filesystem. This token was particularly dangerous as it reportedly carried bypass_2fa: true permissions, granting publishing rights to both public Zapier developer packages and private internal components.

The ultimate target identified was zapier-design-system, a private package loaded into every authenticated zapier.com session. Gaining publishing rights to this package meant that a malicious update could inject attacker-controlled JavaScript directly into the browser context of any logged-in Zapier user, effectively enabling platform-wide stored cross-site scripting (XSS) and subsequent account takeovers.

While an attacker would not directly gain access to raw OAuth tokens or third-party API credentials, which remain server-side, this browser execution path would allow them to impersonate the victim within Zapier’s authenticated interface. This could involve creating or modifying Zaps, Tables, MCP servers, and workflows utilizing the victim’s existing application connections.

In a separate but related discovery, the research also detailed a narrower exposure involving a hardcoded Zapier Actions MCP key found within a LiteLLM-related container. This token authenticated as a legitimate user, enabling actions such as sending emails through connected services, highlighting how embedded secrets can pose immediate identity risks even without a broader platform compromise.

The findings underscore a crucial architectural lesson: simply scrubbing secrets from environment variables after code execution begins is insufficient if untrusted code operates within the same process that previously held those credentials. Furthermore, the incident highlights a common pitfall in CI/CD pipelines where sensitive build secrets are passed via ARG or ENV, allowing them to persist in image metadata long after they are presumed to be removed.

Token Security reported the vulnerability to Zapier on February 12, 2026. Zapier responded within hours, promptly revoking the exposed NPM token and tightening the ECR role by February 16. Full remediation was confirmed by March 5, 2026. The researchers received the maximum $3,000 bounty for their disclosure, and Zapier committed to reviewing its bounty cap as part of its incident response process.

The Zapocalypse incident serves as a stark reminder for defenders that the path to supply-chain compromise often begins with seemingly minor misconfigurations. The confluence of failures in runtime isolation, least privilege principles, secure secret handling, and robust package publishing controls can transform a “sandbox” environment into a gateway for platform-wide breaches.

What You Should Do

• Implement robust runtime isolation for untrusted code execution environments to prevent credential leakage.
• Review and enforce the principle of least privilege for all IAM roles and service accounts, ensuring they only have necessary permissions.
• Audit CI/CD pipelines to prevent sensitive information, such as API tokens and secrets, from being embedded in container image metadata.
• Regularly rotate all API keys, tokens, and credentials, especially those with elevated privileges or bypass capabilities.
• Conduct periodic security audits and penetration tests on your application’s architecture, focusing on potential exploit chains involving multiple misconfigurations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.