--- id: "INC-zeabur-1091243" page: "https://infrastack.ai/live/INC-zeabur-1091243" kind: "incident" aliases: [] title: "Zeabur: attacker read environment variables, account data and shared-cluster databases (Oct 14-15, 2026)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Zeabur", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["gcp-dedicated-server", "hosted-platform", "incident", "n8n", "new-api", "secrets", "security", "shared-cluster", "vendor", "zeabur"] not_affected_if: ["migrated-env-vars-to-own-dedicated-server", "no-zeabur-account"] published_at: "2026-10-15T16:08:00+00:00" first_seen_at: "2026-11-08T16:58:33+00:00" updated_at: "2026-11-08T16:59:56+00:00" sources: [{"source": "statuspage", "url": "https://status.zeabur.com/incident/1091243", "first_seen_at": "2026-11-08T16:58:33+00:00"}, {"source": "analyst", "url": "https://zeabur.com/blogs/october-2026-security-incident", "first_seen_at": "2026-11-08T16:59:56+00:00", "cites": ["https://zeabur.com/blogs/october-2026-security-incident", "https://status.zeabur.com/incident/1091243"]}] exploit_sources: [] --- # Zeabur: attacker read environment variables, account data and shared-cluster databases (Oct 14-15, 2026) Link for people: https://infrastack.ai/live/INC-zeabur-1091243 (this .md is for agents) Zeabur's preliminary report says that on Oct 14-15, 2026 an attacker used leaked internal credentials (plaintext cluster admin tokens, AWS and GCP keys) to enter the shared cluster in 9 regions, root into 101 GCP Dedicated Servers, and join the internal network. From there the attacker read the platform database: 3,218,965 environment-variable records, 321,810 accounts, 566 plaintext zSend keys, and 11,536 hashed access tokens. Commands ran in 865 shared-cluster database services. Zeabur says it revoked the entry points, signed out all users and revoked all access tokens. Hetzner and DigitalOcean server admin access could not be confirmed as used. The investigation is ongoing and Zeabur says it will shut down on Dec 31, 2026. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Zeabur affected range not listed fixed no fixed version listed ## How to check Exposed if you ran services on Zeabur's shared cluster, a GCP Dedicated Server, or kept environment variables stored on Zeabur (not migrated to your own Dedicated Server after August). Check: (1) list the secrets in your Zeabur service env vars and config files. All of them count as leaked. (2) GitHub: audit log for the Zeabur GitHub App between Oct 15 15:05 and 18:54 UTC (clones, pushes, deploy keys, webhooks). (3) GCP Dedicated Servers: look for unknown SSH keys (including comment @zeabur-pentest), google-sudoers, crontab, systemd services, k3s workloads, and sign-ins since Sep 1, 2026. (4) Hetzner/DigitalOcean servers: check the provider console for a root password reset or reinstall after Oct 14. (5) Review third-party usage and bills since Oct 14 (Sep 1 for GCP servers). (6) PostgreSQL: look for unknown roles, functions, triggers, scheduled jobs, extensions. ## Timeline - 2026-10-15T16:08:00+00:00 confirmed by Zeabur (statuspage) https://status.zeabur.com/incident/1091243 "The attacker used compromised internal credentials to access our shared clusters and some GCP dedicated servers, then read environment variables, account information, and project data from the platform database." - 2026-11-08T16:58:33+00:00 statuspage https://status.zeabur.com/incident/1091243 - 2026-11-08T16:59:56+00:00 analyst https://zeabur.com/blogs/october-2026-security-incident — Read Zeabur's blog report and status page (primary). Rotation per vendor: revoke and replace every env-var credential; sign in again and recreate Access Tokens; recreate zSend keys; shared cluster users change passwords inside databases (changing env vars on Zeabur does not change them), n8n encryption key plus stored credentials, new-api/one-api upstream keys; tpe1 and hkg1 database backups treated as leaked; GCP Dedicated Servers: treat as compromised and rebuild. No CVE or fix version applies: it is a vendor incident. Tier C so only who_affected and how_to_check marked verified. Skipped X search. Exploited set true as the vendor confirms attacker access. ## Documents - [advisory] Zeabur October 2026 security incident (preliminary report) https://zeabur.com/blogs/october-2026-security-incident - [describes] Zeabur status: Unauthorized Access to Zeabur Infrastructure and User Data https://status.zeabur.com/incident/1091243 ## From the sources We have published our preliminary report on the October 2026 Zeabur security incident. It details the attack paths identified so far, the scope of impact, the causes, and the remediation measures we have completed. The investigation is ongoing, and the report will be updated as new evidence becomes available. The attacker used compromised internal credentials to access our shared clusters and some GCP dedicated servers, then read environment variables, account information, and project data from the platform database. We have revoked the relevant credentials, blocked known entry points, and adjusted access controls and backup practices. Exposed data may still be misused. Please follow the report’s guidance to replace affected passwords and keys, even if you already replaced them after the August incident. We are responsible for failing to fully implement credential rotation and security improvements. We sincerely apologize to all affected users. If this incident resulted in additional charges from third-party services, please submit a compensation request through a support ticket. We will review the relevant records and explain our findings. We will be transparent about both the confirmed facts and the questions that remain unresolved. Incident report: https://zeabur.com/blogs/october-2026-security-incident --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_