Mastra platform hit by build outage and Railway security breach
Mastra says its hosted platform suffered a two-part incident on October 21, 2026: a builds outage in the early morning, followed by a security breach at its infrastructure provider Railway. According to Mastra, users' environment variables may have been accessed by third parties, though the company has no evidence of a breach of its users at this time.
- Mastra's builds system went down early on October 21, 2026, followed by a Railway security breach announced around 2:50pm PT.
- Mastra platform users' environment variables may have been accessed, but the company has no evidence of a breach of its users at this time.
- Users could not rotate keys for several hours without taking down production, because builds were down.
- Mastra is considering moving off Railway and is building multi-provider hosting and a failover system.
- Mastra open-source is not affected.
Two incidents in one day
Mastra describes the day as a severe incident that played out in two parts. The first began early in the morning Pacific Time, when the platform's builds system went down. Mastra opened an incident on its status page at 02:27 PT, citing build failures caused by an upstream provider outage.
The second part was more serious. At around 2:50pm PT, Railway announced a security breach. Mastra says this means environment variables of Mastra platform users may have been accessed by third parties. The company stresses it does not have evidence that its users were breached at this time. Mastra also notes that the incident concerns the platform only and does not affect Mastra open-source.
The key rotation dilemma
Mastra calls the hardest part of the incident the quandary its users faced. When Railway disclosed the breach, Railway's builds system, and therefore Mastra's, was still down. According to Mastra, that meant users could not rotate their keys for several hours without taking down their production application.
Because environment variables were not propagating to production during the outage, the company did not recommend rolling keys unless users saw suspicious activity. Instead it advised monitoring for signs of unauthorized access. At 18:14 PT, Mastra told platform users to check the logs of services with keys stored on the platform and listed three steps:
- Check access logs.
- Check if any new users or tokens were created that you don't recognize.
- Check the balance and activity from API tokens from AI inference providers that you have configured.
Timeline of the response
Mastra first reported the incident internally at 02:11 PT. By 13:32 PT, the upstream provider was expecting builds to return within the hour, and Mastra had started work on a fallback deployment system. At 14:59 PT, Railway's status page acknowledged the security breach, and Railway communicated this to Mastra over Slack DMs.
At 16:38 PT, after investigating with Railway and related providers, Mastra warned customers on its status page to monitor API keys and related systems for suspicious activity. Builds were confirmed running again at 20:59 PT. Railway gave Mastra the go-ahead to rebuild, and the team said it would test internal projects first and then rotate Mastra platform specific keys for each project.
At 21:18 PT, Mastra sent platform users an updated report over shared Slack channels and email, with instructions on how and when to rotate keys. At 22:44 PT the incident moved to monitoring, with the team still helping customers rotate keys.
What changes for Mastra platform users
Mastra says it is accelerating pre-planned control plane work over the next few weeks. The aim is to allow hosting on other providers and to build a failover system to avoid prolonged outages. The company is considering moving off Railway entirely, or limiting Railway to a subset of free tier users.
It expects to receive more details from Railway over the next few days and says it will pass them on. Platform users who have not yet done so should follow the company's guidance on log checks and key rotation. Mastra apologized for the disruption and invited users to get in touch with questions.
