Zeabur: attacker read project environment variables (API keys, database passwords) via NextChat RCE and leaked AWS root key, Aug 27, 2026

Incident Investigation Update

Before publishing our full investigation report, we would like to share the facts we have confirmed so far, our current understanding of the scope of the incident, and answers to several frequently asked questions.

The information below is based on the system logs, access records, and other evidence currently available to us. As our investigation with third-party security specialists is still ongoing, some conclusions may be updated if additional evidence becomes available.

Confirmed Attack Path

Based on our investigation so far, the attacker obtained a leaked internal AWS administrative credential belonging to Zeabur and used it to access our shared AWS cluster in the Tokyo region.

After gaining access to the cluster, the attacker was able to obtain VPN access to our control-plane network and subsequently connect to Zeabur’s primary database.

Following discovery of the incident, we immediately revoked and rotated the affected credentials and further restricted and hardened the relevant access paths.

Confirmed Data Access Activity

We are continuing to analyze the available database access records and related system logs.

So far, we have identified targeted queries and exports involving users’ environment variables (Variables). Based on the query patterns and subsequent activity, the attacker appears to have been specifically targeting AI service API keys and other directly usable credentials.

For other categories of sensitive data, including customer information, service configuration, and server configuration, the records currently available to us primarily show aggregate or exploratory operations, such as counting records or checking data sizes.

At this time, we have not found direct evidence that the attacker performed bulk reads or exports of the underlying data in these categories.

However, it is important to clarify that the absence of direct evidence does not allow us to completely rule out the possibility that other data may have been accessed. This remains part of the ongoing investigation.