Railway Says Attacker Decrypted Customer Secrets After Build-Isolation Escape
Summary
Railway says an attacker exploited build isolation and an OIDC misconfiguration to decrypt customer environment variables. Up to 100,000 workspaces may have been affected; unauthorized AI-key spending is estimated at $740,000.
Key points
- Railway says an attacker accessed and decrypted a subset of customer environment variables between October 20 and 21, 2026; up to 1.85% of workspaces, or roughly 100,000, could have been affected.
- The attack began with an unknown vulnerability that enabled partial escape from build isolation and access to host files and an internal build credential.
- The attacker used the credential to access an internal Temporal cluster and build histories, then exploited an OIDC binding misconfiguration to obtain short-lived cloud credentials.
- Railway reported that the attacker queried production data and decrypted matching keys; the accessed credentials included GitHub OAuth tokens for 1,852 users.
- Railway estimates unauthorized spending on stolen keys at about $740,000. It said investigators found no evidence of access to customer databases or customer source-code repositories.
- Railway revoked credentials, invalidated sessions and tokens, notified affected customers to rotate stored secrets, and is rolling out builds in dedicated ephemeral virtual machines.
Article Details
- Victim Organization
- Railway
- Incident Type
- Unauthorized access and decryption of customer environment variables and credentials following a build-isolation escape and exploitation of an OIDC misconfiguration.
- Incident Date
- 2026-10-20
- Data Types Exposed
- Customer environment variables, including AI provider credentials and selected cloud, database, and payment keys
- Bring Your Own Key (BYOK) agent keys
- GitHub OAuth tokens
- Stored build histories and sealed variables
- Railway internal build credentials, SSH private key, and cached internal monorepo snapshot
- Host virtual machine files
- Affected Records
- Railway said up to 1.85% of workspaces—roughly 100,000 environments—could have had variables decrypted; it described this as a confirmed upper bound, not a count of confirmed individual records. GitHub OAuth tokens for 1,852 users were accessed, and histories and sealed variables of 353 builds were read.
- Operational Impact
- Railway estimated unauthorized spending on stolen credentials at approximately $740,000 across external AI platforms. Engineers halted customer builds twice, revoked credentials and tokens, and invalidated user sessions, CLI tokens, and project tokens.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsThe attacker used a stolen internal build credential accepted by the self-hosted Temporal cluster as a trusted client, and later used short-lived cloud credentials obtained through the OIDC misconfiguration.T1552.001 · Credentials In FilesThe attacker accessed a longer-lived credential stored on the orchestration server and used it to decrypt customer variables.T1552.004 · Private KeysThe attacker retrieved an internal SSH private key and used it to connect to a fleet orchestration machine.
Vendors
Amazon Web ServicesAWS Bedrock and Google Gemini are already processing fraud refunds directly through their account teams.AnthropicMeanwhile, Railway is covering all breached key costs out of pocket for Anthropic and OpenRouter users.GitHubFurthermore, the decrypted data included linked-account credentials such as Bring Your Own Key (BYOK) agent keys and GitHub OAuth tokens for 1,852 users.GitLabStarting at 09:25 UTC, the team sent key hashes to GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google, and Stripe for emergency revocation.GoogleAWS Bedrock and Google Gemini are already processing fraud refunds directly through their account teams.OpenAIFor OpenAI and SpaceXSI charges, affected users should open a vendor support ticket and share the Case ID with Railway.OpenRouterMeanwhile, Railway is covering all breached key costs out of pocket for Anthropic and OpenRouter users.RailwayRailway Security Incident Exposes Customer Environment Variables and AI KeysSpaceXSIFor OpenAI and SpaceXSI charges, affected users should open a vendor support ticket and share the Case ID with Railway.StripeStarting at 09:25 UTC, the team sent key hashes to GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google, and Stripe for emergency revocation.
Products
AWS BedrockAWS Bedrock and Google Gemini are already processing fraud refunds directly through their account teams.Google GeminiAWS Bedrock and Google Gemini are already processing fraud refunds directly through their account teams.RailwayRailway Security Incident Exposes Customer Environment Variables and AI KeysTemporalAlthough engineers intended that credential only for image registry pushes, an internal self-hosted Temporal cluster accepted it as a trusted client.