# N-able's Passportal Sent Your Master Keys to the Cloud — Then Any Website Could Steal Them
When a managed service provider logs into Passportal, they're trusting one tool with the keys to potentially hundreds of client environments. That trust just took a significant hit.
James Arnott, founder of Bay Area Labs, disclosed on July 8 that Passportal — the credential management product from N-able, the company that spun out of the old SolarWinds MSP division — contained a flaw allowing any website a user visited to obtain complete, persistent access to their entire password vault. The vendor issued a patch the following day. But Arnott says even the patched product carries residual risk, and his explanation of why points to something more troubling than a fixable code defect: it's the architecture itself.
## How the Vault Gets Handed Over
Most password managers keep their most dangerous operations local. The master password derives a secret key on your device, that key decrypts your stored credentials, and the plaintext only appears in your browser. The cloud never sees the key. This is deliberate. It means that even if the vendor's servers are breached, your credentials remain encrypted garbage.
Passportal works differently — and that difference is the vulnerability.
When a Passportal user authenticates, their master password generates access and refresh tokens. The access token carries the secret decryption key. When a user wants to retrieve a credential, that token travels to N-able's servers, N-able uses it to decrypt the vault contents, and the plaintext comes back down. The cloud is the decryption engine.
This design choice transforms every browser session into a potential attack surface. Because the access token lives in the browser, any malicious website — through cross-site scripting, a malicious ad, a compromised third-party script — could grab that token. Not just the contents of the current session. The token grants persistent, complete access to the entire vault. Every credential the MSP manages. Every client environment they've secured. Everything.
For a tool marketed to organizations managing dozens or hundreds of downstream clients, that's not a single-company breach scenario. It's a keychain for the whole building.
## The "Patch" Doesn't Change the Geometry
Arnott's warning that even the patched version carries risk isn't a hedge — it's a structural observation. Patching a specific exploit path doesn't change the fact that the decryption key must exist in the browser and must travel to external servers for this product to function as designed.
Contrast that with the standard approach: if your vault key never leaves your device in decryptable form, there's no token for a malicious site to steal. The attack surface simply doesn't exist.
N-able's choice to build decryption into their cloud service creates a category of risk that can't be patched away without rethinking the product. Individual vulnerabilities can be closed. Architectural exposure requires architectural change.
The question Arnott raises — whether password managers for MSPs should operate over the cloud at all — is legitimate and uncomfortable. Cloud-based password management offers real advantages: easier deployment, centralized administration, no local infrastructure to maintain. For MSPs managing hundreds of clients, those advantages are meaningful. But the security tradeoffs deserve explicit acknowledgment, not implicit acceptance.
## The SolarWinds Shadow Hasn't Lifted
N-able's origin story matters here. The company was formerly SolarWinds MSP, and it carries that lineage into every conversation about MSP security. The 2020 SolarWinds supply chain compromise — one of the most consequential intrusions in recent history — demonstrated exactly why MSPs are priority targets. Compromise one MSP and you often get passive access to dozens of client networks.
N-able spun off from SolarWinds in 2021 partly to distance itself from that association. Its products were not directly implicated in the Orion attack. But the targeting logic that made SolarWinds so valuable to state-sponsored attackers applies equally to any MSP tooling vendor, and Passportal's design amplifies that logic considerably. A working exploit against this vulnerability isn't a single-company breach. It's a skeleton key across the MSP's entire client roster.
The timing of this disclosure — five years after the SolarWinds incident reshaped how the security industry thinks about MSP software — makes the architectural decisions here difficult to excuse.
---
## HackWire Analysis
This vulnerability is being reported as a bug. It's more accurately described as a design decision with catastrophic security implications.
The distinction matters because patches don't fix design decisions. N-able closed the specific exploit path Arnott identified, but the underlying architecture — cloud-based decryption that requires sensitive tokens to traverse the browser — creates a persistent attack surface that no single patch can eliminate. Anyone treating this as "patched and done" is misreading the disclosure.
The MSP context makes this particularly concerning. MSPs using Passportal aren't protecting their own credentials in isolation. They're storing the credentials for every client environment they manage — Active Directory accounts, firewall consoles, cloud infrastructure. The blast radius from a single compromised MSP vault is, by design, enormous. This is why threat actors have consistently treated MSP software as high-value targets since at least 2019, when CISA first issued guidance specifically warning MSPs about credential theft campaigns.
What's missing from most coverage of this incident is the market structure problem. MSPs gravitate toward tools like Passportal because the centralized administration is genuinely useful — one pane of glass for thousands of credentials across hundreds of clients is operationally compelling. But that consolidation creates exactly the kind of high-value, single-point-of-failure target that sophisticated attackers exploit. The market incentivizes convenience over security architecture, and vendors respond accordingly.
Defenders at MSPs should pull Passportal's access logs for the period before the July 9 patch and look for anomalous access patterns. The token-based access model means any exploitation would appear as legitimate authenticated requests — which makes detection harder, not easier. Any credential stored in Passportal during the exposure window should be treated as potentially compromised and rotated, particularly for high-privilege accounts.
The broader lesson: when evaluating any cloud-based credential management tool, ask where decryption actually happens. If the answer involves the vendor's servers rather than your local machine, you are trusting not just their software but their entire cloud infrastructure — and every browser session that touches it.
— HackWire Editorial
---
## Related Coverage