Forest Global Training Partners

Cyber Risks · Krebs on Security

CISA Admin Leaked AWS Gov Cloud Keys on Github

Summary: A CISA contractor maintained a public GitHub repository named "Private-CISA" that exposed credentials to three highly privileged AWS GovCloud accounts, plaintext usernames and passwords for dozens of internal CISA systems, and the agency's internal artifactory, with the repository created on November 13, 2025. GitGuardian researcher Guillaume Valadon flagged the repository on May 15 after its owner did not respond, and the account was taken offline shortly after KrebsOnSecurity and Seralys notified CISA, though the exposed AWS keys remained valid for another 48 hours.

What you should know: The exposed artifactory is a repository of the code packages CISA uses to build software, which Seralys founder Philippe Caturegli described as a prime place to move laterally by backdooring packages that get deployed on every build. The commit logs also show the administrator disabled GitHub's default setting that blocks publishing secrets, and many internal credentials used passwords consisting of the platform name followed by the current year.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related