BreachPublished 18 May 2026

CISA Admin Leaked AWS GovCloud Keys on Github

Source Krebs on Security

Description

A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) publicly exposed highly privileged AWS GovCloud credentials and numerous internal system passwords in a GitHub repository. The repository contained plaintext passwords, cloud keys, tokens, and internal documentation related to CISA's software development and deployment processes. The exposure lasted from November 2025 until May 2026, when the repository was taken offline after notification. CISA confirmed awareness and ongoing investigation, stating no indication of data compromise so far. The exposed credentials included administrative access to multiple AWS GovCloud accounts and internal repositories, posing a significant security risk.

Impact

The exposure of highly privileged AWS GovCloud credentials and internal system passwords publicly on GitHub creates a critical risk of unauthorized access to sensitive government cloud infrastructure and internal systems. If exploited, attackers could gain persistent footholds, move laterally within CISA networks, and potentially backdoor software packages used internally. The leak also reveals internal operational practices and build processes, which could aid attackers in crafting targeted attacks. Although CISA states no evidence of compromise currently exists, the exposure duration and sensitivity of the data represent a significant security incident with potential for severe impact if exploited.

Defensive guidance

CISA has taken the exposed GitHub repository offline and is investigating the incident. The exposed AWS keys remained valid for 48 hours after notification and should be considered compromised; therefore, immediate revocation and rotation of all exposed credentials is essential. CISA and its contractors should enforce strict secret management policies, including enabling GitHub's secret scanning features and prohibiting plaintext credential storage in repositories. Additional safeguards and security training should be implemented to prevent recurrence. Patch status is not applicable as this is a credential exposure incident rather than a software vulnerability.

Summary

A contractor for CISA maintained a public GitHub repository named 'Private-CISA' that contained sensitive credentials including administrative AWS GovCloud keys, plaintext passwords for internal systems, tokens, and internal build and deployment documentation. The repository was publicly accessible from November 2025 until May 2026. Security researchers discovered the exposure and notified CISA, after which the repository was removed. The exposed AWS keys provided high privilege access to three AWS GovCloud accounts, and plaintext credentials included access to internal CISA systems such as the Landing Zone DevSecOps environment and the internal artifactory repository. The contractor had disabled GitHub's default secret scanning protections, and used poor security practices such as easily guessable passwords. CISA is investigating and has not confirmed any compromise. The incident highlights serious operational security failures within CISA and its contractor.

References

krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Jun 2026, 11:55 UTC

References

Community reviews