Railway says attackers used a previously unknown flaw in its build infrastructure and a second cloud-identity weakness to reach internal systems and decrypt some customer environment variables, including credentials for AI services, a target also seen in the Fireworks AI breach and the OpenCode API-key incident. In its November 10 incident report, the developer platform said unauthorized use of stolen keys generated an estimated $740,000 in charges. Railway said at most 1.85% of its workspaces, about 100,000, could have had some variables decrypted; the figure is an upper bound, not a count of confirmed stolen keys.
The first entry point was a vulnerability in Railway’s multi-tenant build system. The attacker partially escaped filesystem isolation and read files on the host machine, obtaining a credential used by build servers to access internal services. Railway said the credential also worked as a trusted client to its internal Temporal task system, allowing the attacker to retrieve selected build histories and a snapshot of Railway’s own monorepo.
After examining the codebase, the attacker found an incorrectly configured OpenID Connect binding in a cloud environment and used it to obtain a short-lived cloud credential. That access led to longer-lived internal credentials stored on an orchestration machine and access to the network containing Railway’s production database of encrypted environment variables. Railway said database queries specifically searched for AI-provider credentials, and the attacker used its key-management service to decrypt some of the retrieved values.
Railway said the attacker read histories for 353 builds and obtained linked-account tokens, including BYOK agent keys and GitHub OAuth tokens, associated with 1,852 users. The company reset those tokens and found no logins to Railway accounts using credentials taken in the incident. It also said its investigation found no evidence that customer databases were accessed. Some cloud, database and payment-service credentials were also among the variable names queried.
The company said the attacker was removed from its systems by October 21 and that it has closed the vulnerabilities and configuration weaknesses used in the attack. Railway rebuilt internal tooling, rotated infrastructure credentials, and accelerated a move to isolated, single-tenant build machines. It is working with AI providers on refunds for the estimated $740,000 in unauthorized usage and said it would cover losses where providers do not reimburse customers.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
