Railway Says Intruder Exposed Customer Secrets and AI Keys

Railway says a security incident in October 2026 allowed an attacker to decrypt customer environment variables across up to about 100,000 workspaces, exposing AI provider credentials and a range of cloud, database and payment keys. Forensic logs indicate the intruder targeted AI credentials specifically, reading the histories and sealed variables of 353 builds on 20 October. The decryption also included linked-account credentials such as BYOK agent keys and GitHub OAuth tokens for around 1,852 users.

Railway’s post‑mortem states there was no evidence of access to customer databases or downloads of customer source code repositories. The company says only a subset of environments was affected, with the incident potentially impacting roughly 1.85% of workspaces, and that unauthorized spend on stolen keys amounted to about $740,000.

How it happened, and what was affected: Railway describes two phases beginning with dummy account probing on 18 October. A build‑infrastructure vulnerability allowed partial filesystem isolation escape, enabling the intruder to read host VM files and steal a build credential. Even after credentials were revoked, the attacker used the stolen monorepo to look for new flaws and, on 21 October, exploited an OIDC binding misconfiguration to obtain short‑lived cloud credentials.

These steps enabled access to an internal SSH key and a production‑environment decryption key for envelope‑encrypted variables. Affected users are those storing third‑party API credentials in environment variables; Rail­way says all static and active cloud credentials were subsequently revoked, key decryption restricted to the secrets service, and a new isolated build architecture rolled out.

The firm has filed with the FBI IC3, engaged an external forensics firm, and joined Project Glasswing; refunds and reassessment of affected AI billing are being coordinated with providers.