{"id":"INC-zeabur-1091243","kind":"incident","aliases":[],"related":[],"title":"Zeabur: attacker read environment variables, account data and shared-cluster databases (Oct 14-15, 2026)","description":"We have published our preliminary report on the October 2026 Zeabur security incident. It details the attack paths identified so far, the scope of impact, the causes, and the remediation measures we have completed. The investigation is ongoing, and the report will be updated as new evidence becomes available.\n\nThe attacker used compromised internal credentials to access our shared clusters and some GCP dedicated servers, then read environment variables, account information, and project data from the platform database. We have revoked the relevant credentials, blocked known entry points, and adjusted access controls and backup practices. Exposed data may still be misused. Please follow the report’s guidance to replace affected passwords and keys, even if you already replaced them after the August incident.\n\nWe are responsible for failing to fully implement credential rotation and security improvements. We sincerely apologize to all affected users. If this incident resulted in additional charges from third-party services, please submit a compensation request through a support ticket. We will review the relevant records and explain our findings.\n\nWe will be transparent about both the confirmed facts and the questions that remain unresolved.\n\nIncident report:\n\nhttps://zeabur.com/blogs/october-2026-security-incident","summary":"Zeabur's preliminary report says that on Oct 14-15, 2026 an attacker used leaked internal credentials (plaintext cluster admin tokens, AWS and GCP keys) to enter the shared cluster in 9 regions, root into 101 GCP Dedicated Servers, and join the internal network. From there the attacker read the platform database: 3,218,965 environment-variable records, 321,810 accounts, 566 plaintext zSend keys, and 11,536 hashed access tokens. Commands ran in 865 shared-cluster database services. Zeabur says it revoked the entry points, signed out all users and revoked all access tokens. Hetzner and DigitalOcean server admin access could not be confirmed as used. The investigation is ongoing and Zeabur says it will shut down on Dec 31, 2026.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":null,"products":[{"name":"Zeabur","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["gcp-dedicated-server","hosted-platform","incident","n8n","new-api","secrets","security","shared-cluster","vendor","zeabur"],"not_affected_if":["migrated-env-vars-to-own-dedicated-server","no-zeabur-account"],"how_to_check":"Exposed if you ran services on Zeabur's shared cluster, a GCP Dedicated Server, or kept environment variables stored on Zeabur (not migrated to your own Dedicated Server after August). Check: (1) list the secrets in your Zeabur service env vars and config files. All of them count as leaked. (2) GitHub: audit log for the Zeabur GitHub App between Oct 15 15:05 and 18:54 UTC (clones, pushes, deploy keys, webhooks). (3) GCP Dedicated Servers: look for unknown SSH keys (including comment @zeabur-pentest), google-sudoers, crontab, systemd services, k3s workloads, and sign-ins since Sep 1, 2026. (4) Hetzner/DigitalOcean servers: check the provider console for a root password reset or reinstall after Oct 14. (5) Review third-party usage and bills since Oct 14 (Sep 1 for GCP servers). (6) PostgreSQL: look for unknown roles, functions, triggers, scheduled jobs, extensions.","fix":null,"status":"open","published_at":"2026-10-15T16:08:00+00:00","first_seen_at":"2026-11-08T16:58:33+00:00","triaged_at":"2026-11-08T16:59:11+00:00","updated_at":"2026-11-08T16:59:56+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-08T16:59:11Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources say to follow the report's guidance to replace affected passwords and keys, but the report itself was not read","reach":"internet","title":"Zeabur: attacker read environment variables, account and project data","impact":"high","summary":"Zeabur reports that an attacker used compromised internal credentials to reach shared clusters and some GCP dedicated servers, then read environment variables, account information and project data from the platform database. Exposed secrets may still be misused, so the company asks users to replace affected passwords and keys.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["zeabur","hosted-platform","secrets"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads environment variables, account data and project data from database","analyst_note":"Read the preliminary report at https://zeabur.com/blogs/october-2026-security-incident for affected scope, confirmed versions and the exact rotation guidance.","how_to_check":"- Review the Zeabur incident report at https://zeabur.com/blogs/october-2026-security-incident to see whether your projects or services are in scope\n- Check the environment variables and keys stored in your Zeabur projects, since these may have been read\n- unknown for any other check","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-zeabur-account"],"who_is_affected":"Users of Zeabur's hosted platform whose environment variables, account information or project data were stored in the platform database. The report's scope section decides whether a given project was in scope. Teams that never used Zeabur are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000775,"input_tokens":4815,"output_tokens":587,"severity_before":"unknown","breached_checked":true},"analyst_status":"done","analyst_note":"Read the preliminary report at https://zeabur.com/blogs/october-2026-security-incident for affected scope, confirmed versions and the exact rotation guidance.","search":"'-15':15A,50B '/blogs/october-2026-security-incident':358C '101':76B '1091243':20A '11':108B '14':14A,49B '2026':16A,51B,164B,174C '218':94B '3':93B '31':163B '321':100B '536':109B '566':103B '810':101B '865':116B '9':72B '965':95B 'access':111B,136B,143B,221C,255C 'account':6A,102B,234C 'addit':313C 'adjust':254C 'admin':60B,142B 'affect':274C,306C 'alreadi':281C 'api':33B 'apolog':303C 'attack':2A,53B,88B,181C,215C 'august':286C 'avail':213C 'aw':62B 'backup':258C 'becom':212C 'block':249C 'caus':191C 'charg':314C 'cluster':11A,38B,59B,70B,119B,224C 'command':113B 'compens':323C 'complet':198C 'compromis':217C 'confirm':147B,346C 'control':256C 'could':144B 'credenti':57B,219C,248C,296C 'data':7A,238C,261C 'databas':12A,92B,120B,242C 'dec':162B 'dedic':24B,78B,228C 'detail':179C 'digitalocean':140B 'enter':67B 'entri':127B,251C 'environ':4A,97B,232C 'environment-vari':96B 'even':278C 'evid':211C 'explain':336C 'expos':260C 'fact':347C 'fail':292C 'far':185C 'find':338C 'follow':267C 'fulli':294C 'gcp':23B,64B,77B,227C 'gcp-dedicated-serv':22B 'guidanc':271C 'hash':110B 'hetzner':138B 'host':27B 'hosted-platform':26B 'identifi':183C 'impact':189C 'implement':295C 'improv':300C 'inc':18A 'inc-zeabur':17A 'incid':29B,177C,287C,310C,354C 'inform':235C 'intern':56B,83B,218C 'investig':151B,200C 'join':81B 'key':65B,106B,277C 'known':250C 'leak':55B 'may':262C 'measur':195C 'misus':265C 'n8n':30B 'network':84B 'new':32B,210C 'new-api':31B 'oct':13A,48B 'octob':173C 'ongo':153B,202C 'parti':318C 'password':275C 'path':182C 'plaintext':58B,104B 'platform':28B,91B,241C 'pleas':266C,320C 'point':128B,252C 'practic':259C 'preliminari':43B,169C 'project':237C 'publish':167C 'question':350C 'ran':114B 'read':3A,89B,231C 'record':99B,334C 'region':73B 'relev':247C,333C 'remain':352C 'remedi':194C 'replac':273C,282C 'report':44B,170C,205C,269C,355C 'request':324C 'respons':290C 'result':311C 'review':331C 'revok':125B,134B,245C 'root':74B 'rotat':297C 'say':45B,123B,156B 'scope':187C 'secret':34B 'secur':35B,176C,299C 'server':25B,79B,141B,229C 'servic':121B,319C 'share':10A,37B,69B,118B,223C 'shared-clust':9A,36B,117B 'shut':159B 'sign':129B 'sincer':302C 'still':263C 'submit':321C 'support':327C 'third':317C 'third-parti':316C 'ticket':328C 'token':61B,112B,137B 'transpar':342C 'unresolv':353C 'updat':208C 'use':54B,149B,216C 'user':132B,307C 'variabl':5A,98B,233C 'vendor':39B 'zeabur':1A,19A,21A,40B,41B,122B,155B,175C 'zeabur.com':357C 'zeabur.com/blogs/october-2026-security-incident':356C 'zsend':105B","nicknames":[],"mitigations":[],"who_affected":"Users of Zeabur's hosted platform whose environment variables, account information or project data were stored in the platform database. The report's scope section decides whether a given project was in scope. Teams that never used Zeabur are not affected.","tier":"C","verified":{"how_to_check":{"at":"2026-11-08T16:59:56Z","by":"analyst","doc":"https://zeabur.com/blogs/october-2026-security-incident","run_id":2195},"who_affected":{"at":"2026-11-08T16:59:56Z","by":"analyst","doc":"https://zeabur.com/blogs/october-2026-security-incident","run_id":2195}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["zeabur"],"ptokens":["zeabur"],"labels":["gcpdedicatedserver","high","hostedplatform","incident","n8n","newapi","secrets","security","sharedcluster","vendor","zeabur"],"campaign_type":null,"search_a":"'-15':15A '1091243':20A '14':14A '2026':16A 'account':6A 'attack':2A 'cluster':11A 'data':7A 'databas':12A 'environ':4A 'inc':18A 'inc-zeabur':17A 'oct':13A 'read':3A 'share':10A 'shared-clust':9A 'variabl':5A 'zeabur':1A,19A,21A","search_b":"'-15':50B '101':76B '11':108B '14':49B '2026':51B,164B '218':94B '3':93B '31':163B '321':100B '536':109B '566':103B '810':101B '865':116B '9':72B '965':95B 'access':111B,136B,143B 'account':102B 'admin':60B,142B 'api':33B 'attack':53B,88B 'aw':62B 'cluster':38B,59B,70B,119B 'command':113B 'confirm':147B 'could':144B 'credenti':57B 'databas':92B,120B 'dec':162B 'dedic':24B,78B 'digitalocean':140B 'enter':67B 'entri':127B 'environ':97B 'environment-vari':96B 'gcp':23B,64B,77B 'gcp-dedicated-serv':22B 'hash':110B 'hetzner':138B 'host':27B 'hosted-platform':26B 'incid':29B 'intern':56B,83B 'investig':151B 'join':81B 'key':65B,106B 'leak':55B 'n8n':30B 'network':84B 'new':32B 'new-api':31B 'oct':48B 'ongo':153B 'plaintext':58B,104B 'platform':28B,91B 'point':128B 'preliminari':43B 'ran':114B 'read':89B 'record':99B 'region':73B 'report':44B 'revok':125B,134B 'root':74B 'say':45B,123B,156B 'secret':34B 'secur':35B 'server':25B,79B,141B 'servic':121B 'share':37B,69B,118B 'shared-clust':36B,117B 'shut':159B 'sign':129B 'token':61B,112B,137B 'use':54B,149B 'user':132B 'variabl':98B 'vendor':39B 'zeabur':40B,41B,122B,155B 'zsend':105B","search_c":"'/blogs/october-2026-security-incident':358C '2026':174C 'access':221C,255C 'account':234C 'addit':313C 'adjust':254C 'affect':274C,306C 'alreadi':281C 'apolog':303C 'attack':181C,215C 'august':286C 'avail':213C 'backup':258C 'becom':212C 'block':249C 'caus':191C 'charg':314C 'cluster':224C 'compens':323C 'complet':198C 'compromis':217C 'confirm':346C 'control':256C 'credenti':219C,248C,296C 'data':238C,261C 'databas':242C 'dedic':228C 'detail':179C 'entri':251C 'environ':232C 'even':278C 'evid':211C 'explain':336C 'expos':260C 'fact':347C 'fail':292C 'far':185C 'find':338C 'follow':267C 'fulli':294C 'gcp':227C 'guidanc':271C 'identifi':183C 'impact':189C 'implement':295C 'improv':300C 'incid':177C,287C,310C,354C 'inform':235C 'intern':218C 'investig':200C 'key':277C 'known':250C 'may':262C 'measur':195C 'misus':265C 'new':210C 'octob':173C 'ongo':202C 'parti':318C 'password':275C 'path':182C 'platform':241C 'pleas':266C,320C 'point':252C 'practic':259C 'preliminari':169C 'project':237C 'publish':167C 'question':350C 'read':231C 'record':334C 'relev':247C,333C 'remain':352C 'remedi':194C 'replac':273C,282C 'report':170C,205C,269C,355C 'request':324C 'respons':290C 'result':311C 'review':331C 'revok':245C 'rotat':297C 'scope':187C 'secur':176C,299C 'server':229C 'servic':319C 'share':223C 'sincer':302C 'still':263C 'submit':321C 'support':327C 'third':317C 'third-parti':316C 'ticket':328C 'transpar':342C 'unresolv':353C 'updat':208C 'use':216C 'user':307C 'variabl':233C 'zeabur':175C 'zeabur.com':357C 'zeabur.com/blogs/october-2026-security-incident':356C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-15T16:08:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"zeabur:1091243","url":"https://status.zeabur.com/incident/1091243","severity":null,"published_at":"2026-10-15T16:08:00+00:00","modified_at":"2026-10-15T16:08:00+00:00","first_seen_at":"2026-11-08T16:58:33+00:00","fetched_at":"2026-11-09T02:40:09+00:00","note":null},{"source":"analyst","external_id":"INC-zeabur-1091243:2195","url":"https://zeabur.com/blogs/october-2026-security-incident","severity":null,"published_at":"2026-11-08T16:59:56+00:00","modified_at":"2026-11-08T16:59:56+00:00","first_seen_at":"2026-11-08T16:59:56+00:00","fetched_at":"2026-11-08T16:59:56+00:00","note":"Read Zeabur's blog report and status page (primary). Rotation per vendor: revoke and replace every env-var credential; sign in again and recreate Access Tokens; recreate zSend keys; shared cluster users change passwords inside databases (changing env vars on Zeabur does not change them), n8n encryption key plus stored credentials, new-api/one-api upstream keys; tpe1 and hkg1 database backups treated as leaked; GCP Dedicated Servers: treat as compromised and rebuild. No CVE or fix version applies: it is a vendor incident. Tier C so only who_affected and how_to_check marked verified. Skipped X search. Exploited set true as the vendor confirms attacker access.","cites":["https://zeabur.com/blogs/october-2026-security-incident","https://status.zeabur.com/incident/1091243"]}],"documents":[{"id":102605,"url":"https://zeabur.com/blogs/october-2026-security-incident","title":"Zeabur October 2026 security incident (preliminary report)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":102606,"url":"https://status.zeabur.com/incident/1091243","title":"Zeabur status: Unauthorized Access to Zeabur Infrastructure and User Data","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[{"company":"Zeabur","domain":"status.zeabur.com","url":"https://status.zeabur.com/incident/1091243","kind":"statuspage","published_at":"2026-10-15T16:08:00+00:00","quote":"The attacker used compromised internal credentials to access our shared clusters and some GCP dedicated servers, then read environment variables, account information, and project data from the platform database.","confidence":0.9700000286102295,"source":"statuspage","created_at":"2026-11-08T17:12:29+00:00","entry":"stolen-credential"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}