2026 Zeabur — customer NextChat app exploited to reach internal systems; project secrets and AWS account exposed
Data compromised
Project environment variables (names and values: third-party AI/service API keys, cloud credentials, database passwords, signing keys); account and AI Hub data queried; AWS account accessed; part of the production database read. Zeabur published no counts.
Technical writeup
Verified Zeabur post (Sep 7, 2026). Earliest unusual API requests Aug 27 02:34 UTC; database intrusion from 07:54; bulk reads of project environment variables from 11:52. Zeabur learned of it from an API-key-abuse report on Aug 28 and notified users the same day. Response disabled Legacy API Keys and rotated internal keys, but missed the plaintext cluster admin token and AWS keys later used in the October breach (zeabur-shared-cluster2026). No victim count published; recordsAffected 0.
Root cause
A user-deployed NextChat v2.16.1 service on a shared cluster was exploited (CVE-2026-7644, MCP authorization checks) for code execution; weak isolation let the attacker reach a routing cache holding Zeabur Legacy API Keys and use a team administrator key; an AWS root key sat in an internal service’s variables.