Railway Warns Users to Rotate Secrets After Potential Environment Variable Exposure

Cloud hosting provider Railway issued an urgent security warning earlier this week after detecting suspicious activity involving systems that store customers’ environment variables.

The company said its investigation indicates that an unauthorized third party may have accessed encrypted environment variables and, in some cases, obtained their decrypted contents. Railway is urging all users to proactively rotate their secrets and credentials.

“Our investigation to date has revealed that an unauthorized third party may have accessed encrypted environment variables and, in some cases, obtained the decrypted contents,” Railway said.

Environment variables may contain sensitive information, including API keys, database credentials, and private registry credentials.

Railway users urged to rotate credentials

Railway is a cloud platform that developers use to deploy and run applications, APIs, databases, and other backend services. The company says it has approximately 4.8 million users and hosts more than 16 million services.

The platform stores deployment-related configuration settings and credentials in environment variables, which may have been exposed during the incident.

Railway said the incident was part of a series of attacks targeting AI inference providers. The company directly notified affected providers and advised them to disable all keys as a precaution.

An AI inference provider is a service that runs AI models and returns answers. Railway also provides a guide to hosting AI inference applications.

Although Railway’s initial analysis suggests that only some users may be affected, the company has asked all customers to immediately rotate environment variables and secrets stored on the platform. This includes private registry credentials. Users should also review related service logs for unusual activity.

Railway deployment status

Railway paused all deployments while its investigation continued, preventing users from deploying new application versions during the disruption.

According to the Railway status page, as of October 22 at 08:44 UTC, builds had been restored for Pro and Enterprise workspaces. However, deployments remained delayed, with multiple jobs waiting in queues.

Builds for Hobby, Free, and Trial workspaces had not yet restarted and were scheduled to be restored in that order.

Railway said it would directly notify users whose accounts were confirmed to have been compromised and provide additional details.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report