Zeabur to shut down after a non-expiring admin token opened its shared cluster
Zeabur says an attacker used a shared-cluster admin token created in January 2024 with no expiry, plus internal AWS keys, all stored in plaintext in a private config repo, to read 3.2 million environment-variable records. The developer hosting platform will close by December 31, 2026.
Developer hosting platform Zeabur published a preliminary incident report on October 19 saying an attacker used its own internal credentials to take over its shared cluster on October 14 and 15. The keys were a shared-cluster admin token created on January 10, 2024 with no expiry, plus internal AWS keys, both stored in plaintext in a private configuration repository and usable from the public internet. Zeabur suspects they were obtained in its August breach, when a GitHub App private key was read and replaced but the plaintext credentials were not rotated. The attacker read 3,218,965 environment-variable records covering 321,810 accounts, the platform database, and settings for 865 hosted database services, added SSH keys to 50 dedicated servers, and called the API as two impersonated accounts. Zeabur rotated its login signing key on October 15 and, per BleepingComputer, will shut down by December 31, 2026.
Why it matters
Every failure here is a non-human identity control: a token with no expiry, a credential stored in plaintext, an admin path reachable from anywhere, and an incident response that rotated the key that was known stolen but not the secrets that key could reach. A platform that holds customers' environment variables is a secrets manager whether it calls itself one or not.
If you deployed on Zeabur, treat every variable as leaked: revoke API keys, cloud keys, database passwords and signing keys at the provider first, then redeploy. Rebuild GCP dedicated servers, and check the GitHub audit log for Zeabur GitHub App actions between 15:05 and 18:54 UTC on October 15. For your own platforms, give admin tokens an expiry, keep them out of repositories, and make secrets rotation after any breach cover everything the stolen key could read.
Source: Zeabur
Related on Start with Identity
- BlogNorthflank tells customers to assume every environment variable was decrypted after AI keys are abused
After a Wiz alert on October 30, cloud platform Northflank told customers to assume all environment variables were decrypted and rotate every key. Customers the
- BlogRailway says an attacker decrypted environment variables in up to 100,000 workspaces
Railway's October 22 preliminary report says an attacker pulled encrypted customer environment variables, obtained CI credentials to decrypt a subset, and hunte
- BlogTrigger.dev says an attacker read environment variables for a subset of customer organizations
AI workflow platform Trigger.dev disclosed on November 1 that an attacker gained unauthorized access to environment variables for a subset of organizations. It
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVELiteLLM MCP gateway accepts any Bearer token after key validation fails
LiteLLM's MCP Streamable HTTP endpoint fell back to an empty auth object when key validation failed, so a fabricated Authorization header reached the gateway's