Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keys
Zeabur's October 19, 2026 preliminary report says an intrusion began on October 14 with an internal AWS key and a shared-cluster admin token created in January 2024 with no expiry, both stored in plaintext in a private configuration repository; how the attacker obtained them is not confirmed. The attack triggered no alerts for more than 16 hours and exposed 321,810 accounts and about 3.2 million environment-variable records. Zeabur, a developer hosting platform, has announced it will shut down on December 31, 2026 and describes that as an operational decision.
- Victim
- Zeabur
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Oct 14, 2026
- First disclosed
- Oct 19, 2026
- Actor
- Unattributed
- Initial access
- Exposed secrets
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- 321,810 (Accounts (email, username, phone and profile data), plus 3,218,965 service environment-variable records, per Zeabur's preliminary report.)
- Disclosed cost
- Not disclosed
The identity lesson
A never-expiring cluster admin token and static cloud keys sat in a repository. Short-lived, scoped machine credentials issued at runtime, and keeping admin interfaces off the public internet, remove the single point of failure.
Go deeper on SWI
- Technique: Secrets in repositories and CI
- Technique: Static API key abuse
- SWI coverage: zeabur to shut down after a non expiring admin token opened its shared cluster
Sources
- Zeabur October 2026 security incident (preliminary report), Zeabur, Oct 19, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- JadePuffer wipes Azure resources with compromised service principals 2026 · Exposed secrets
- Codecov Bash Uploader compromise via credential extracted from Docker image 2021 · Exposed secrets
- Internet Archive user database theft and Zendesk token abuse 2024 · Exposed secrets
- LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key 2026 · Exposed secrets
Cite this record
SWI Community Team. (2026). Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keys. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-zeabur-plaintext-admin-token/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.