{"id":3191,"date":"2026-05-18T21:00:46","date_gmt":"2026-05-18T21:00:46","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/"},"modified":"2026-05-18T21:00:46","modified_gmt":"2026-05-18T21:00:46","slug":"cisa-admin-leaked-aws-govcloud-keys-on-github","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/","title":{"rendered":"CISA Admin Leaked AWS GovCloud Keys on Github"},"content":{"rendered":"
\n

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency<\/strong> (CISA) maintained a public GitHub<\/strong> repository that exposed credentials to several highly privileged AWS GovCloud<\/strong> accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.<\/p>\n

On May 15, KrebsOnSecurity heard from Guillaume Valadon<\/strong>, a researcher with the security firm GitGuardian<\/strong>. Valadon\u2019s company\u00a0constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures. Valadon said he reached out because the owner in this case wasn\u2019t responding and the information exposed was highly sensitive.<\/p>\n

\"\"<\/a><\/p>\n

A redacted screenshot of the now-defunct \u201cPrivate CISA\u201d repository maintained by a CISA contractor.<\/p>\n<\/div>\n

The GitHub repository that Valadon flagged was named \u201cPrivate-CISA<\/strong>,\u201d and it harbored a vast number of internal CISA\/DHS credentials and files, including cloud keys, tokens, plaintext passwords, logs and other sensitive CISA assets.<\/p>\n

Valadon said the exposed CISA credentials represent a textbook example of poor security hygiene, noting that the commit logs in the offending GitHub account show that the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories.<\/p>\n

\u201cPasswords stored in plain text in a csv, backups in git, explicit commands to disable GitHub secrets detection feature,\u201d Valadon wrote in an email. \u201cI honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I\u2019ve witnessed in my career. It is obviously an individual\u2019s mistake, but I believe that it might reveal internal practices.\u201d<\/p>\n

One of the exposed files, titled \u201cimportantAWStokens,\u201d included the administrative credentials to three Amazon AWS GovCloud servers. Another file exposed in their public GitHub repository \u2014 \u201cAWS-Workspace-Firefox-Passwords.csv\u201d \u2014 listed plaintext usernames and passwords for dozens of internal CISA systems. According to Caturegli, those system included one called \u201cLZ-DSO,\u201d which appears short for \u201cLanding Zone DevSecOps,\u201d the agency\u2019s secure code development environment.<\/p>\n

Philippe Caturegli<\/strong>, founder of the security consultancy Seralys<\/strong>, said he tested the AWS keys only to see whether they were still valid and to determine which internal systems the exposed accounts could access. Caturegli said the GitHub account that exposed the CISA secrets exhibits a pattern consistent with an individual operator using the repository as a working scratchpad or synchronization mechanism rather than a curated project repository.<\/p>\n

\u201cThe use of both a CISA-associated email address and a personal email address suggests the repository may have been used across differently configured environments,\u201d Caturegli observed. \u201cThe available Git metadata alone does not prove which endpoint or device was used.\u201d<\/p>\n

\"\"<\/p>\n

The Private CISA GitHub repo exposed dozens of plaintext credentials for important CISA GovCloud resources.<\/p>\n<\/div>\n

Caturegli said he validated that the exposed credentials could authenticate to three AWS GovCloud accounts at a high privilege level. He said the archive also includes plain text credentials to CISA\u2019s internal \u201cartifactory\u201d \u2014 essentially a repository of all the code packages they are using to build software \u2014 and that this would represent a juicy target for malicious attackers looking for ways to maintain a persistent foothold in CISA systems.<\/p>\n

\u201cThat would be a prime place to move laterally,\u201d he said. \u201cBackdoor in some software packages, and every time they build something new they deploy your backdoor left and right.\u201d<\/p>\n

In response to questions, a spokesperson for CISA said the agency is aware of the reported exposure and is continuing to investigate the situation.<\/p>\n

\u201cCurrently, there is no indication that any sensitive data was compromised as a result of this incident,\u201d the CISA spokesperson wrote. \u201cWhile we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.\u201d<\/span><\/p>\n

A review of the GitHub account and its exposed passwords show the \u201cPrivate CISA\u201d repository was maintained by a contractor employed by Nightwing<\/strong>, a government contractor based in Dulles, Va. Nightwing declined to comment, directing inquiries to CISA.<\/p>\n

CISA has not responded to questions about the potential duration of the data exposure, but Caturegli said the Private CISA repository was created on November 13, 2025. The contractor\u2019s GitHub account was created back in September 2018.<\/p>\n

The GitHub account that included the Private CISA repo was taken offline shortly after both KrebsOnSecurity and Seralys notified CISA about the exposure. But Caturegli said the exposed AWS keys inexplicably continued to remain valid for another 48 hours.<\/p>\n

The now-defunct Private CISA repo showed the contractor also used easily-guessed passwords for a number of internal resources; for example, many of the credentials used a password consisting of each platform\u2019s name followed by the current year. Caturegli said such practices would constitute a serious security threat for any organization even if those credentials were never exposed externally, noting that threat actors often use key credentials exposed on the internal network to expand their access after establishing initial access to a targeted system.<\/p>\n

\u201cWhat I suspect happened is [the CISA contractor] was using this GitHub to synchronize files between a work laptop and a home computer, because he has regularly committed to this repo since November 2025,\u201d Caturegli said. \u201cThis would be an embarrassing leak for any company, but it\u2019s even more so in this case because it\u2019s CISA.\u201d<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[113,1162,90,1163,567,1164,296,1165,143,1166,1167,1168,176],"tags":[91],"class_list":["post-3191","post","type-post","status-publish","format-standard","hentry","category-a-little-sunshine","category-aws-govcloud","category-cybersecurity","category-cybersecurity-infrastructure-security-agency","category-data-breaches","category-gitguardian","category-github","category-guillaume-valadon","category-latest-warnings","category-nightwing","category-philippe-caturegli","category-seralys","category-the-coming-storm","tag-cybersecurity"],"yoast_head":"\nCISA Admin Leaked AWS GovCloud Keys on Github - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CISA Admin Leaked AWS GovCloud Keys on Github - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-18T21:00:46+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"CISA Admin Leaked AWS GovCloud Keys on Github\",\"datePublished\":\"2026-05-18T21:00:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/\"},\"wordCount\":909,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/privatecisa.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"A Little Sunshine\",\"AWS GovCloud\",\"Cybersecurity\",\"Cybersecurity & Infrastructure Security Agency\",\"Data Breaches\",\"GitGuardian\",\"GitHub\",\"Guillaume Valadon\",\"Latest Warnings\",\"Nightwing\",\"Philippe Caturegli\",\"Seralys\",\"The Coming Storm\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/\",\"name\":\"CISA Admin Leaked AWS GovCloud Keys on Github - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/privatecisa.png\",\"datePublished\":\"2026-05-18T21:00:46+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#primaryimage\",\"url\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/privatecisa.png\",\"contentUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/privatecisa.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CISA Admin Leaked AWS GovCloud Keys on Github\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CISA Admin Leaked AWS GovCloud Keys on Github - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/","og_locale":"en_US","og_type":"article","og_title":"CISA Admin Leaked AWS GovCloud Keys on Github - Imperative Business Ventures Limited","og_description":"Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and […]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-05-18T21:00:46+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"CISA Admin Leaked AWS GovCloud Keys on Github","datePublished":"2026-05-18T21:00:46+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/"},"wordCount":909,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/privatecisa.png","keywords":["Cybersecurity"],"articleSection":["A Little Sunshine","AWS GovCloud","Cybersecurity","Cybersecurity & Infrastructure Security Agency","Data Breaches","GitGuardian","GitHub","Guillaume Valadon","Latest Warnings","Nightwing","Philippe Caturegli","Seralys","The Coming Storm"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/","name":"CISA Admin Leaked AWS GovCloud Keys on Github - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/privatecisa.png","datePublished":"2026-05-18T21:00:46+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#primaryimage","url":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/privatecisa.png","contentUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/privatecisa.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/18\/cisa-admin-leaked-aws-govcloud-keys-on-github\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"CISA Admin Leaked AWS GovCloud Keys on Github"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=3191"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3191\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=3191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=3191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=3191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}