---
title: Zeabur breach: attacker read 3.2M stored environment variables and 321,810 accounts, ran commands in 865 customer databases and got root on 101 GCP servers; PaaS will shut down Dec 31 | ctxsec
url: https://ctxsec.com/items/zeabur-oct-2026-breach-platform-db-shutdown
description: "Zeabur's Oct 19 preliminary report says leaked long-lived internal credentials, stored in plaintext in a private config repo, let an attacker into its shared Kubernetes cluster, 101 GCP dedicated servers and finally the platform database on Oct 14-15 (UTC). Zeabur tells every user to replace all credentials stored on the platform, even ones rotated after its August incident. The company announced Oct 17 that it will shut down by Dec 31, 2026."
status: "confirmed (Zeabur preliminary incident report Oct 19; shutdown notice Oct 17)"
published: 2026-10-20
---

> Zeabur's Oct 19 preliminary report says leaked long-lived internal credentials, stored in plaintext in a private config repo, let an attacker into its shared Kubernetes cluster, 101 GCP dedicated servers and finally the platform database on Oct 14-15 (UTC). Zeabur tells every user to replace all credentials stored on the platform, even ones rotated after its August incident. The company announced Oct 17 that it will shut down by Dec 31, 2026.

[← Cybersecurity News](/news) · [markdown](/items/zeabur-oct-2026-breach-platform-db-shutdown.md)

confirmed (Zeabur preliminary incident report Oct 19; shutdown notice Oct 17)

2026-10-20

### Zeabur breach: attacker read 3.2M stored environment variables and 321,810 accounts, ran commands in 865 customer databases and got root on 101 GCP servers; PaaS will shut down Dec 31

Zeabur, a cloud deployment platform popular for hosting n8n, AI API gateways and vibe-coded apps, published a preliminary report on Oct 19 for its second breach in under two months. According to Zeabur, from **Oct 14, 01:36 UTC** the attacker used internal AWS keys and shared-cluster admin tokens that were stored in plaintext in a private configuration repository. The tokens had never expired (created January 2024), the cluster admin interface was reachable from the internet, and none of these credentials had been rotated after the August incident. How the attacker got them is unconfirmed. Zeabur's leading hypothesis is the GitHub App private key leaked in August.

**What Zeabur says was taken or touched** (its own certainty labels):

- Platform database (confirmed): **3,218,965** service environment-variable records (names and values) and **321,810** accounts (email, username, phone), plus project data. 566 zSend API keys were stored in plaintext and have been revoked. The 11,536 platform access tokens were stored only as hashes, and all were revoked.
- Shared cluster: settings and secrets of all services in 9 regions. Read commands ran inside **865** customer database services, including 736 n8n instances on PostgreSQL. In 602 of the 607 n8n instances checked, the encryption key sat in an environment variable, so stored third-party credentials were effectively exposed in plaintext. A program planted in at least two Tokyo PostgreSQL databases called back to an external host.
- GCP dedicated servers: root sign-ins on **101** servers (92 users), with attacker SSH keys added on 50. Root passwords were stored in plaintext in server initialization settings, a problem Zeabur found on Sept 3 but hadn't fixed.
- About 53 production secrets read, the GitHub App private key among them (rotated Oct 15 18:54 UTC; no use found so far). Hetzner and DigitalOcean management tokens also leaked; whether they were used can't be confirmed.

Zeabur says the attacker mainly hunted for directly usable API keys, especially AI-service keys, and tried, without success, to call Amazon Bedrock with Zeabur's AWS keys. It also suspects that a user's OpenAI key was abused on Oct 16 for about 1,107 image-generation requests. The last attacker activity was Oct 15, 21:05 UTC. More than 16 hours of activity on Oct 14 triggered no alerts, and the investigation began only after a user report.

**Do now if you use or used Zeabur:** don't wait for an email. Revoke and replace every credential stored in Zeabur environment variables, including any you rotated after August. Change passwords _inside_ your databases, since changing the env var doesn't change the database password. Replace the n8n encryption key and recreate all n8n credentials. Revoke upstream AI keys used by new-api/one-api. Check your GitHub audit log for Zeabur GitHub App actions between Oct 15 15:05 and 18:54 UTC. Treat GCP dedicated servers as compromised and rebuild them. Review cloud and AI-provider bills from Oct 14 onward, or from Sept 1 for GCP servers. Separately, Zeabur announced on Oct 17 that it is winding down: dedicated-server renewals stop Dec 1 and all servers and shared clusters stop by **Dec 31, 2026**. Plan the migration alongside the rotation.

Sources: [Zeabur: October 2026 security incident (preliminary report, Oct 19)](https://zeabur.com/blogs/october-2026-security-incident) · [Zeabur: shutting down (Oct 17)](https://zeabur.com/blogs/zeabur-is-shutting-down) · [Zeabur status: incidents](https://status.zeabur.com/incidents)