Zeabur: plaintext admin credentials led to platform DB and cluster breach; service shutting down
Severity: critical · Patch status: partial · Since 2026-10-15
Zeabur, a Taiwan-based app hosting platform, says that on 14 and 15 October 2026 an attacker used long-lived admin credentials and cloud keys that were stored in plaintext in a private configuration repository, and that could be used from the public internet, to enter its shared cluster; the cluster admin interface was open to the public internet at the time. Its preliminary report of 19 October says the attacker read service settings and environment variables across the platform (3,218,965 records and 321,810 accounts, both marked confirmed), ran commands in 865 database services (not every command succeeded), signed in as root on 101 GCP dedicated servers (50 of which received an attacker SSH key), queried the platform database and obtained one customer database backup. Exposed secrets included 566 plaintext zSend API keys, all revoked, and 11,536 hashed access tokens. Zeabur says it found the intrusion after a user report, about 36 hours after first credential use, with no alert firing. How the attacker first obtained the credentials is not established; the report calls a link to the August incident, where a GitHub App private key was read on 27 August, a hypothesis with no direct evidence. On 17 October Zeabur announced it is shutting down: new server and domain purchases stopped at once, dedicated server renewals end on 1 December, and all servers and shared clusters stop by 31 December 2026, with no data-deletion or final-export date set yet. Wiz lists Zeabur among at least nine AI developer platforms with October 2026 incidents and describes that wave as aimed at stored environment variables and AI provider keys.
What to do
- Revoke every credential stored in Zeabur environment variables at the issuing provider first (AI/LLM keys, cloud keys, DB passwords, signing and encryption keys), then reissue and redeploy, even if already rotated after the August incident
- Recreate Zeabur access tokens and zSend API keys; check the GitHub audit log for Zeabur GitHub App activity from 2026-10-15 15:05 to 18:54 UTC
- Shared-cluster users: change passwords inside your databases (env vars do not change them), replace the n8n encryption key and recreate its credentials, revoke upstream keys in new-api/one-api, and audit PostgreSQL for unknown roles, functions, triggers, jobs and extensions; treat Taipei (tpe1) and Hong Kong (hkg1) backups as leaked
- GCP dedicated server users: treat the server as compromised, back up data and rebuild; check authorized_keys for the comment ending @zeabur-pentest and sign-in logs back to 2026-09-01
- Review cloud and AI provider bills from 2026-10-14 for abuse and file a compensation request via Zeabur Support if charged
- Plan migration now: dedicated servers stop on their expiry date from 2026-12-01, all services end by 2026-12-31; export database backups before shutdown
Sources
All live incidents on Threat Watch
