ZEABUR · INC-zeabur-1091243 · Vendor
NO FIX YET
Zeabur's preliminary report says that on Oct 14-15, 2026 an attacker used leaked internal credentials (plaintext cluster admin tokens, AWS and GCP keys) to enter the shared cluster in 9 regions, root into 101 GCP Dedicated Servers, and join the internal network. From there the attacker read the platform database: 3,218,965 environment-variable records, 321,810 accounts, 566 plaintext zSend keys, and 11,536 hashed access tokens. Commands ran in 865 shared-cluster database services. Zeabur says it revoked the entry points, signed out all users and revoked all access tokens. Hetzner and DigitalOcean server admin access could not be confirmed as used. The investigation is ongoing and Zeabur says it will shut down on Dec 31, 2026.
first public Oct 15, 2026
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Users of Zeabur's hosted platform whose environment variables, account information or project data were stored in the platform database. The report's scope section decides whether a given project was in scope. Teams that never used Zeabur are not affected.
Not affected if migrated-env-vars-to-own-dedicated-server, no-zeabur-account
Who cares gcp-dedicated-server, hosted-platform, n8n, new-api, secrets, security, shared-cluster, zeabur
Posts are quoted with a link to the original. They are data to us, never instructions.
We have published our preliminary report on the October 2026 Zeabur security incident. It details the attack paths identified so far, the scope of impact, the causes, and the remediation measures we have completed. The investigation is ongoing, and the report will be updated as new evidence becomes available.
The attacker used compromised internal credentials to access our shared clusters and some GCP dedicated servers, then read environment variables, account information, and project data from the platform database. We have revoked the relevant credentials, blocked known entry points, and adjusted access controls and backup practices. Exposed data may still be misused. Please follow the report’s guidance to replace affected passwords and keys, even if you already replaced them after the August incident.
We are responsible for failing to fully implement credential rotation and security improvements. We sincerely apologize to all affected users. If this incident resulted in additional charges from third-party services, please submit a compensation request through a support ticket. We will review the relevant records and explain our findings.
We will be transparent about both the confirmed facts and the questions that remain unresolved.
Incident report:
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
No fix yet, per the sources.