--- id: "INC-zeabur-1037896" page: "https://infrastack.ai/live/INC-zeabur-1037896" kind: "incident" aliases: [] title: "Zeabur: attacker read project environment variables (API keys, database passwords) via NextChat RCE and leaked AWS root key, Aug 27, 2026" severity: "high" cvss: null epss: null exploited: false status: "open" category: "vendor" products: [{"name": "Zeabur", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["ai-api-keys", "credential-rotation", "cve-2026-7644", "environment-variables", "hosted-platform", "incident", "nextchat", "security", "vendor", "zeabur"] not_affected_if: ["no-zeabur-usage"] published_at: "2026-08-28T07:11:00+00:00" first_seen_at: "2026-11-08T16:58:33+00:00" updated_at: "2026-11-08T17:00:39+00:00" sources: [{"source": "statuspage", "url": "https://status.zeabur.com/incident/1037896", "first_seen_at": "2026-11-08T16:58:33+00:00"}, {"source": "analyst", "url": "https://zeabur.com/blogs/august-2026-security-incident", "first_seen_at": "2026-11-08T17:00:39+00:00", "cites": ["https://zeabur.com/blogs/august-2026-security-incident", "https://status.zeabur.com/incident/1037896"]}] exploit_sources: [] --- # Zeabur: attacker read project environment variables (API keys, database passwords) via NextChat RCE and leaked AWS root key, Aug 27, 2026 Link for people: https://infrastack.ai/live/INC-zeabur-1037896 (this .md is for agents) On Aug 27, 2026 an attacker exploited CVE-2026-7644 (NextChat v2.16.1, MCP authorization checks) in a user service on Zeabur's Tokyo shared cluster. They read a routing cache holding Legacy API Keys, used a team admin's key to read an internal service's environment variables, and found an AWS root key. From the shared cluster they reached the production database through a maintenance job's credential. Zeabur confirmed the names and values of project environment variables were read, including AI and third-party API keys, cloud credentials, database passwords and signing keys. Zeabur found no evidence that other data was read. The attacker also created AI Hub access keys, which Zeabur says were never used and have been revoked. The incident is resolved and the full report is published. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Zeabur affected range not listed fixed no fixed version listed ## How to check - Zeabur sent notices on Aug 28 (08:53 and 17:03 UTC) asking affected users to replace every third-party credential involved. If you hold such a notice, or had projects on Zeabur around Aug 27-28, 2026, treat every environment variable value in them as exposed. - List the variables in each project (AI keys, cloud keys, database passwords, signing keys) and check provider dashboards for unrecognised usage. - Also check if you ran NextChat v2.16.1 anywhere; CVE-2026-7644 is the reported entry point. - Misused AI keys: file a support request at zeabur.com/support with provider usage screenshots. ## Fix Zeabur says it closed the intrusion path, rotated internal credentials and disabled all Legacy API Keys. User action: rotate every third-party credential stored as a Zeabur environment variable (AI API keys, cloud keys, database passwords, signing keys), as Zeabur's notices asked. For NextChat, upgrade beyond v2.16.1; I did not read the fixed version, so check the CVE-2026-7644 advisory. ## Timeline - 2026-11-08T16:58:33+00:00 statuspage https://status.zeabur.com/incident/1037896 - 2026-11-08T17:00:39+00:00 analyst https://zeabur.com/blogs/august-2026-security-incident — Read vendor status page and full Sep 7 report. The incident is resolved. Scope is the confirmed read of project env vars; AI Hub keys were created by the attacker but not used. Rotation is advised. Triage mentioned regions; the report names only the Tokyo shared cluster (hnd1). Sibling INC-zeabur-1091243 is a separate Oct 2026 incident. I did not read the truncated tail of the report or the NextChat advisory. No fix version stated for NextChat. fix-status none is not right for the platform, so see the fix text. ## Documents - [advisory] Zeabur August 2026 security incident (full report) https://zeabur.com/blogs/august-2026-security-incident - [advisory] Zeabur status: Unauthorized Access to Project Environment Variable Data https://status.zeabur.com/incident/1037896 ## From the sources ## Incident Investigation Update Before publishing our full investigation report, we would like to share the facts we have confirmed so far, our current understanding of the scope of the incident, and answers to several frequently asked questions. The information below is based on the system logs, access records, and other evidence currently available to us. As our investigation with third-party security specialists is still ongoing, some conclusions may be updated if additional evidence becomes available. ### Confirmed Attack Path Based on our investigation so far, the attacker obtained a leaked internal AWS administrative credential belonging to Zeabur and used it to access our shared AWS cluster in the Tokyo region. After gaining access to the cluster, the attacker was able to obtain VPN access to our control-plane network and subsequently connect to Zeabur’s primary database. Following discovery of the incident, we immediately revoked and rotated the affected credentials and further restricted and hardened the relevant access paths. ### Confirmed Data Access Activity We are continuing to analyze the available database access records and related system logs. So far, we have identified targeted queries and exports involving users’ environment variables (Variables). Based on the query patterns and subsequent activity, the attacker appears to have been specifically targeting AI service API keys and other directly usable credentials. For other categories of sensitive data, including customer information, service configuration, and server configuration, the records currently available to us primarily show aggregate or exploratory operations, such as counting records or checking data sizes. At this time, we have not found direct evidence that the attacker performed bulk reads or exports of the underlying data in these categories. However, it is important to clarify that the absence of direct evidence does not allow us to completely rule out the possibility that other data may have been accessed. This remains part of the ongoing investigation. ### Regarding the “Dark Web” Screenshot Circulating Online We are aware of a screenshot currently circulating in the community claiming that a complete Zeabur database or a large volume of Zeabur customer data is being offered for sale on the dark web. Based on the system records, observed attacker activity, and other evidence collected so far, we have not found evidence supporting the claim that the attacker obtained the complete Zeabur dataset described in that screenshot. At this time, we are unable to verify the origin or authenticity of the screenshot. We are nevertheless including this claim in our ongoing investigation and will update our findings if additional evidence becomes available. ### Third-Party Security Investigation Zeabur is working with professional third-party security specialists to conduct further forensic analysis, reconstruct the attack path, and determine the full scope of impact. If we identify any material new information during this process, we will update the Incident Report and notify affected users as soon as possible. --- ## Frequently Asked Questions ### Q: Will Zeabur compensate users for losses caused by this incident? Yes. We have established an initial compensation process for losses resulting from unauthorized use of credentials exposed in this incident. If you incurred additional charges that were not initiated by you, please submit the relevant information through a Zeabur support ticket, including usage records provided by the affected service provider, timestamps, amounts, and any other information that may help us verify the claim. We will review each case individually and arrange compensation once the claim has been verified. Our current plan is to complete payment arrangements for verified cases no later than **September 30, 2026**. The actual payment method may vary depending on the user’s location and the circumstanc --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_