Unauthorized Access to Project Environment Variable Data

Update timeline

1. investigating Aug 28, 2026, 07:11 AM UTC

   We detected unauthorized access to an internal service credential that was used to retrieve project environment variable records. We revoked the affected credential, blocked the access path, and contained the incident on the same day. Our investigation confirmed exposure of environment variables with the following key names: ACCESS_TOKEN, API_SECRET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, CF_API_TOKEN, CLIENT_SECRET, CLOUDFLARE_API_TOKEN, DIGITALOCEAN_TOKEN, GEMINI_API_KEY, GITHUB_PAT, GITHUB_TOKEN, GOOGLE_API_KEY, LINODE_TOKEN, PRIVATE_KEY, STRIPE_PUBLISHABLE_KEY, STRIPE_SECRET_KEY, ANTHROPIC_API_KEY, OPENROUTER_API_KEY, OPENAI_API_KEY, DATABASE_URL, JWT_SECRET, MONGODB_URI, MYSQL_PASSWORD, POSTGRES_PASSWORD, REDIS_PASSWORD, and SECRET_KEY. We also confirmed exposure of credentials stored under custom variable names when their values matched identifiable AWS, GitHub, Anthropic, OpenRouter, OpenAI, or Stripe credential formats. Affected users are being notified directly with the relevant projects, services, environments, and recommended rotation actions. We strongly recommend that notified users immediately revoke and replace all listed credentials and review the corresponding databases and third-party services for unusual access, usage, or charges. At this time, we have found no evidence that Zeabur account credentials, personal information, server data, payment information, or credit card information were accessed. Our investigation remains ongoing, and we will provide further updates as they become available.

2. resolved Sep 09, 2026, 10:26 PM UTC

   We have completed our investigation into the August 2026 Zeabur security incident and have now published the full incident report. The report provides a detailed account of how the attacker exploited a vulnerability in a user-deployed service to gain access to our shared cluster, progressively escalated their privileges, and ultimately accessed our production environment. It also covers the confirmed scope of impact, the root causes of the incident, and the remediation measures we have completed. We once again sincerely apologize to all users affected by this incident. The majority of the compensation claims we have received have now been verified, and we are working to process the remaining cases as quickly as possible. We want to be as transparent as possible about what we have learned. In the two weeks since the incident, we have already shipped three major security-related architectural updates, and we will continue improving privilege isolation, credential management, and security monitoring across our systems. Full report: https://zeabur.com/blogs/august-2026-security-incident