A contractor for CISA maintained a public GitHub repository named 'Private-CISA' that contained sensitive credentials including administrative AWS GovCloud keys, plaintext passwords for internal systems, tokens, and internal build and deployment documentation. The repository was publicly accessible from November 2025 until May 2026. Security researchers discovered the exposure and notified CISA, after which the repository was removed. The exposed AWS keys provided high privilege access to three AWS GovCloud accounts, and plaintext credentials included access to internal CISA systems such as the Landing Zone DevSecOps environment and the internal artifactory repository. The contractor had disabled GitHub's default secret scanning protections, and used poor security practices such as easily guessable passwords. CISA is investigating and has not confirmed any compromise. The incident highlights serious operational security failures within CISA and its contractor.

The exposure of highly privileged AWS GovCloud credentials and internal system passwords publicly on GitHub creates a critical risk of unauthorized access to sensitive government cloud infrastructure and internal systems. If exploited, attackers could gain persistent footholds, move laterally within CISA networks, and potentially backdoor software packages used internally. The leak also reveals internal operational practices and build processes, which could aid attackers in crafting targeted attacks. Although CISA states no evidence of compromise currently exists, the exposure duration and sensitivity of the data represent a significant security incident with potential for severe impact if exploited.

CISA has taken the exposed GitHub repository offline and is investigating the incident. The exposed AWS keys remained valid for 48 hours after notification and should be considered compromised; therefore, immediate revocation and rotation of all exposed credentials is essential. CISA and its contractors should enforce strict secret management policies, including enabling GitHub's secret scanning features and prohibiting plaintext credential storage in repositories. Additional safeguards and security training should be implemented to prevent recurrence. Patch status is not applicable as this is a credential exposure incident rather than a software vulnerability.