Zeabur: plaintext admin credentials led to platform DB and cluster breach; service shutting down
Severity: critical · Patch status: no-fix-needed · Since 2026-10-15
Zeabur, a Taiwan-based app hosting platform, reports that between 14 and 15 October 2026 an attacker used long-lived admin tokens and cloud keys left in plaintext in a private configuration repository (the cluster admin interface was reachable from the public internet) to enter its shared cluster, read the service settings and environment variables of every service, run commands inside 865 customer database containers, join the internal network, and query the platform database. Confirmed exposure: 3,218,965 environment-variable records, 321,810 accounts, 566 plaintext zSend API keys and 11,536 hashed access tokens; 101 GCP dedicated servers had root sign-ins and 50 got an attacker SSH key. The attacker mainly hunted AI-service keys (including n8n credential stores and new-api/one-api key pools). Detection came 36 hours after first credential use, from a user report, not an alert. Zeabur announced on 17 October that it will shut down, with all servers and shared clusters stopping by 31 December 2026. Wiz counts it among at least nine AI developer platforms breached in October 2026.
What to do
- Revoke every credential stored in Zeabur environment variables at the issuing provider first (AI/LLM keys, cloud keys, DB passwords, signing and encryption keys), then reissue and redeploy, even if already rotated after the August incident
- Recreate Zeabur access tokens and zSend API keys; check the GitHub audit log for Zeabur GitHub App activity from 2026-10-15 15:05 to 18:54 UTC
- Shared-cluster users: change passwords inside your databases (env vars do not change them), replace the n8n encryption key and recreate its credentials, revoke upstream keys in new-api/one-api, and audit PostgreSQL for unknown roles, functions, triggers, jobs and extensions; treat Taipei (tpe1) and Hong Kong (hkg1) backups as leaked
- GCP dedicated server users: treat the server as compromised, back up data and rebuild; check authorized_keys for the comment ending @zeabur-pentest and sign-in logs back to 2026-09-01
- Review cloud and AI provider bills from 2026-10-14 for abuse and file a compensation request via Zeabur Support if charged
- Plan migration now: dedicated servers stop on their expiry date from 2026-12-01, all services end by 2026-12-31; export database backups before shutdown
Sources
All live incidents on Threat Watch
