Railway: build-infrastructure escalation let attacker decrypt a subset of customer environment variables
Severity: critical · Patch status: patched · Since 2026-10-20
Railway, a cloud deployment platform that says it has about 5 million users, was breached from 2026-10-20 through its build infrastructure. A previously unknown flaw let the attacker partly escape build-VM filesystem isolation (probing from 06:50 UTC, exploit at 07:28 UTC). A build-server credential was then accepted as a trusted client by Railway's internal Temporal instance, which exposed stored histories of 353 builds and let the attacker copy Railway's own internal monorepo. Railway names no CVE. A misconfigured OIDC binding gave the attacker short-lived cloud credentials at 03:26 UTC on 2026-10-21. From an orchestration machine it reached a database of envelope-encrypted environment variables (retrieved 04:07-05:21 UTC), prioritised AI provider key names, and decrypted per-environment keys between 04:42 and 07:15 UTC. Railway says at most 1.85% of workspaces (about 100,000) had variables decrypted, an upper bound because its logs identify environments rather than individual variables. Linked-account tokens (BYOK agent keys and GitHub OAuth tokens) for 1,852 users were decrypted; Railway reset them and notified each user. Railway says the attacker was evicted by 09:24 UTC on 2026-10-21 and had no access to customer data after 09:25 UTC; forensics did not indicate customer databases were accessed, it has no indication customer snapshots or repositories were downloaded, and no logins to Railway accounts used the taken credentials. Running deployments stayed up, though revoked credentials stopped some services. Railway's report of 2026-11-10 says the stolen AI keys were used by unidentified parties for coding agents, AI training pipelines and distillation, with about $740,000 of estimated unauthorized spend; it has not established whether the original attacker ran those services. Remediation: from 09:25 UTC on 2026-10-21 Railway asked upstream providers to revoke potentially exposed keys; all user sessions and tokens were invalidated at 20:19 UTC on 2026-10-21; builds resumed from 03:32 UTC on 2026-10-22 (all plans by 22:49 UTC); new signups were paused from 2026-10-22 to 2026-11-02; the build system and CI were rebuilt, each build now gets an ephemeral VM, and every decrypt operation is audit-logged. Refund routes differ by provider, and Railway says it covers some costs itself. An unverified social-media claim of about $371,000 of crypto theft from keys stored on Railway is not confirmed by Railway. The FBI IC3 was notified and a forensics firm is engaged; the investigation is ongoing.
What to do
- Rotate every secret stored in Railway environment variables (AI provider keys, database credentials, private registry credentials, cloud keys), especially anything created before 2026-10-21, revoking at the issuer first
- If you kept wallet keys or seeds in Railway variables, treat them as exposed and move funds to new addresses. The reported ~$371,000 drain is an unconfirmed social-media claim, and Railway has not confirmed it
- Remove public network access to databases; review GitHub audit logs and installed GitHub App access, and registry (for example Docker Hub) activity logs
- Reconnect GitHub, recreate CLI and CI tokens (all Railway tokens were revoked), and redeploy the latest commit since pushes during the pause were not deployed
- Check AI provider billing for unauthorized usage and report unexplained charges through Railway's charge report form; contact each provider first. Per Railway's 2026-11-10 report, AWS Bedrock and Google Gemini say their fraud refund policies cover it, OpenAI and SpaceXSI review claims case by case through Railway support, and Railway is covering breached Anthropic and OpenRouter costs itself for now. This supersedes the earlier guidance that Railway cannot refund spend
Sources
All live incidents on Threat Watch
