CISA Contractor’s Public GitHub Repository Exposes Privileged AWS GovCloud Credentials and Internal Passwords

A public GitHub repository named “Private-CISA” contained administrative credentials for three Amazon AWS GovCloud accounts, plaintext usernames and passwords for dozens of internal CISA systems, and additional secrets such as SSH keys, CI/CD logs, Kubernetes manifests, and tokens for the agency’s internal Artifactory repository. Files titled “importantAWStokens” and “AWS-Workspace-Firefox-Passwords.csv” listed the high-privilege cloud keys and clear-text login data, respectively.

Krebs on SecurityCISA Contractor Exposed AWS GovCloud Keys in Public GitHub Repository, Report SaysCISA GitHub Data Leak: Sensitive Credentials, Passwords Posted to Public RepositoryCISA exposed plaintext passwords and cloud keys on GitHub for six monthsTechRadarCybersecurity And Infrastructure Security Agency GitHub leak exposed passwords, keys — MogazCISA Exposed AWS GovCloud Credentials in Public GitHub Repo — Cybersecurity And Infrastructure Security AgencyGizmodoAlternet

The Cybersecurity and Infrastructure Security Agency (CISA) is the federal office charged with protecting U.S. critical infrastructure. The repository was maintained by an employee of Nightwing, a government contractor based in Dulles, Virginia. According to security analysts, the contractor disabled GitHub’s default secret-detection feature and used the repo as a scratchpad for synchronizing files between a work laptop and a home computer, rather than as a curated project.

CISA Contractor Exposed AWS GovCloud Keys in Public GitHub Repository, Report Says

• 13 Nov 2025 – “Private-CISA” repository created.

Krebs on Security

• Nov 2025 onward – Regular commits indicate ongoing use as a synchronization hub.

CISA exposed plaintext passwords and cloud keys on GitHub for six months

• 14 May 2026 – GitGuardian researcher Guillaume Valadon discovers the public repository.

Krebs on Security

• 15 May 2026 – Valadon alerts KrebsOnSecurity; CISA is notified.

Gizmodo

• 15–16 May 2026 – GitHub account taken offline.

Krebs on Security

• ~48 hours after takedown – The exposed AWS GovCloud keys remained valid before being revoked.

CISA exposed plaintext passwords and cloud keys on GitHub for six months

• Repository size: 844 MB of data.

CISA Contractor Exposed AWS GovCloud Keys in Public GitHub Repository, Report Says

• 3 AWS GovCloud accounts with administrative access.

CISA Contractor Exposed AWS GovCloud Keys in Public GitHub Repository, Report Says

• Dozens of internal system credentials, including the “Landing Zone DevSecOps” (LZ-DSO) environment and the agency’s Artifactory code-package repository.

Cybersecurity And Infrastructure Security Agency GitHub leak exposed passwords, keys — Mogaz

• Additional artifacts: plaintext CSV files, SSH keys, CI/CD logs, and Kubernetes configuration files.

Krebs on Security

CISA confirmed awareness of the exposure and said it is investigating. A spokesperson emphasized that, at the time of reporting, there was no indication that any sensitive data had been compromised. The agency pledged to implement additional safeguards and reiterated its expectation that staff uphold “the highest standards of integrity and operational awareness.”

Krebs on Security

Security researchers highlighted multiple lapses: disabling GitHub’s secret-detection, storing passwords in clear-text CSV files, and using easily guessed passwords (e.g., platform name plus the current year). Guillaume Valadon described the incident as “the worst leak I’ve witnessed in my career.” Philippe Caturegli, founder of Seralys, warned that the exposed assets could enable lateral movement and persistent backdoors within CISA’s software-build pipeline.

Krebs on Security

Sources differ on the exact exposure window. While the repository existed for roughly six months, CISA has not disclosed the precise duration it remained public. No evidence of malicious exploitation has been presented, and the agency has not confirmed whether any external actors accessed the credentials before revocation.

CISA Contractor Exposed AWS GovCloud Keys in Public GitHub Repository, Report Says

• “Passwords stored in plain text in a CSV, backups in git, explicit commands to disable GitHub secrets detection feature. I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I've witnessed in my career.” — Guillaume Valadon, Researcher, GitGuardian

CISA GitHub Data Leak: Sensitive Credentials, Passwords Posted to Public Repository

• “That would be a prime place to move laterally. Backdoor in some software packages, and every time they build something new, they deploy your backdoor left and right,” — Philippe Caturegli, Founder, Seralys

CISA GitHub Data Leak: Sensitive Credentials, Passwords Posted to Public Repository

• “The use of both a CISA-associated email address and a personal email address suggests the repository may have been used across differently configured environments,” — Philippe Caturegli, Founder, Seralys

Krebs on Security

• “What I suspect happened is [the CISA contractor] was using this GitHub to synchronize files between a work laptop and a home computer, because he has regularly committed to this repo since November 2025,” — Philippe Caturegli, Founder, Seralys

Krebs on Security

• “This would be an embarrassing leak for any company, but it’s even more so in this case because it’s CISA.” — Philippe Caturegli, Founder, Seralys

Krebs on Security

CISA has launched an internal investigation and announced plans to strengthen credential-management controls, including reinstating secret-detection mechanisms and tightening contractor oversight. The agency has not detailed a timeline for these measures, but the incident underscores the need for continuous monitoring of public code repositories that may contain sensitive government assets.

Alternet