CISA Admin Reportedly Exposes AWS GovCloud Credentials in Public GitHub Repository

A significant security lapse involving the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has come to light after a contractor reportedly exposed highly sensitive AWS GovCloud credentials in a public GitHub repository.

The incident, disclosed by security researchers on May 15, 2026, is being described as one of the most serious government-related data exposures in recent years.

Exposes AWS GovCloud Credentials

The exposed GitHub repository, named “Private-CISA,” was maintained by a contractor linked to Nightwing, a government services firm. According to researchers from GitGuardian, the repository contained a wide range of sensitive data, including:

• AWS GovCloud access keys with administrative privileges
• Plaintext usernames and passwords stored in CSV files
• Internal system tokens and authentication logs
• Credentials for CISA’s software development infrastructure

One file labeled “importantAWStokens” included credentials granting access to at least three AWS GovCloud environments.

Another file, “AWS-Workspace-Firefox-Passwords.csv,” contained login details for multiple internal systems, including CISA’s “Landing Zone DevSecOps” environment.

Researchers noted that the exposure was not accidental alone but compounded by poor security practices. The repository’s commit history revealed that the user had disabled GitHub’s built-in secret scanning protections, allowing sensitive data to be uploaded without detection.

Additional findings included:

• Passwords stored in plaintext without encryption
• Weak password patterns (e.g., system name + current year)
• Use of GitHub as a file synchronization tool between devices
• Backup files and internal logs are committed directly to the repository

Philippe Caturegli, founder of Seralys, confirmed that some of the exposed AWS credentials were still valid and allowed high-level access when tested.

He also warned that access to internal artifact repositories could enable attackers to inject malicious code into software builds, creating a supply chain risk.

Timeline and Exposure Window

• Repository creation: November 13, 2025
• Public exposure identified: May 2026
• The repository was taken offline shortly after the disclosure
• AWS keys reportedly remained active for up to 48 hours after removal

The GitHub account associated with the leak had been active since 2018, suggesting prolonged use and possible repeated exposure risks.

CISA Response and Ongoing Investigation

As per Krebs on Security, CISA acknowledged the incident and stated that it is actively investigating the exposure. In an official response, the agency noted that there is currently no evidence indicating that sensitive systems were compromised as a result of the leak.

However, the incident raises concerns about internal security controls, particularly given recent staffing reductions within the agency. Reports indicate that CISA has lost nearly one-third of its workforce, potentially impacting operational oversight and security enforcement.

This incident underscores how exposed cloud credentials and poor repository hygiene can quickly escalate into critical security risks. Attackers gaining access to AWS GovCloud keys could move laterally across systems, access sensitive infrastructure, or even manipulate software supply chains by injecting malicious code into internal build environments.

The presence of plaintext passwords and weak credential patterns further increases the likelihood of credential stuffing and privilege escalation attacks. Even if no exploitation is confirmed, the exposure window itself creates a high-risk scenario for persistent threats.

To mitigate such risks, organizations must enforce strict security controls around code repositories and credential management.

This includes enabling automated secret scanning, using secure vaults to store sensitive data rather than plaintext files, and implementing regular key rotation policies to invalidate exposed credentials quickly.

Access to critical systems should follow the principle of least privilege, limiting potential damage if credentials are compromised. Additionally, continuous monitoring, developer security training, and auditing of repository activity can help detect and prevent similar incidents before they escalate.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.