CISA Admin Leaked AWS GovCloud Keys on Github

A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) inadvertently exposed highly privileged credentials for AWS GovCloud accounts and numerous internal CISA systems through a public GitHub repository. Security experts have described the leak as one of the most significant government data exposures in recent history, containing details on CISA's internal software development and deployment processes.

The exposed repository, named "Private-CISA," was maintained by a CISA contractor and contained a substantial amount of sensitive information, including cloud keys, access tokens, plaintext passwords, and system logs. Researchers from GitGuardian, a security firm specializing in scanning public code repositories for exposed secrets, flagged the repository after the account owner did not respond to initial alerts.

According to Guillaume Valadon of GitGuardian, the CISA administrator had disabled GitHub's default security setting designed to prevent the publication of sensitive information like SSH keys. The repository's commit logs indicated this configuration change. Valadon noted that the exposed data included passwords stored in plain text within CSV files and backups committed directly to Git, practices he described as indicative of poor security hygiene.

Among the leaked files were administrative credentials for three Amazon AWS GovCloud servers, found in a file titled "importantAWStokens." Another file, "AWS-Workspace-Firefox-Passwords.csv," contained plaintext usernames and passwords for dozens of internal CISA systems. Philippe Caturegli, founder of the security consultancy Seralys, confirmed that these credentials granted high-level access to the AWS GovCloud accounts.

Caturegli's analysis suggested the GitHub account was used as a personal workspace or synchronization tool rather than a formal project repository. The presence of both a CISA-associated email address and a personal email address in the account's metadata indicated potential use across different computing environments. The exposed credentials could have provided attackers with a significant advantage, allowing them to gain persistent access to CISA systems and potentially inject malicious code into software packages during the build process.

The "Private-CISA" repository, created on November 13, 2025, also contained plaintext credentials for CISA's internal Artifactory, a repository for software build packages. Caturegli stated that compromising this would be a prime target for attackers seeking to establish a foothold and move laterally within the agency's network. The contractor's GitHub account, created in September 2018, was eventually taken offline after the exposure was reported. However, Caturegli observed that the exposed AWS keys remained valid for an additional 48 hours.

In response to the incident, a CISA spokesperson stated that the agency is aware of the exposure and is investigating. The spokesperson added that there is currently no indication of sensitive data compromise but acknowledged the need for enhanced safeguards to prevent future occurrences. The contractor associated with the repository was an employee of Nightwing, a government contractor based in Dulles, Virginia, which declined to comment and referred inquiries to CISA.

The exposed credentials often utilized predictable passwords, such as the platform name followed by the current year. Caturegli highlighted that such weak password practices pose a serious security risk, even if credentials are only exposed internally, as threat actors frequently leverage such information to expand their access after initial compromise. Caturegli speculated that the contractor might have been using the GitHub repository to synchronize files between work and personal computers, given the regular commits since November 2025.