Cloud Security

CISA Leaked Its Own AWS GovCloud Keys on GitHub for Six

May 24, 2026 · 9 min read · By CloudAI Security

CISA Leaked Its Own AWS GovCloud Keys on GitHub for Six Months

The federal agency charged with protecting U.S. critical infrastructure from cyberattacks spent half a year broadcasting its own cloud credentials to the entire internet. A CISA contractor published 844 MB of plaintext passwords, AWS GovCloud admin keys, SAML certificates, and internal infrastructure code in a public GitHub repository named — without a trace of irony — “Private-CISA.” The repo sat exposed from November 13, 2025 until GitGuardian discovered it on May 14, 2026. By then, the damage was already a roadmap for any nation-state patient enough to clone it.

This is not a near-miss. This is the most consequential government credential leak in recent memory, and it came from the agency that publishes the Known Exploited Vulnerabilities catalog and lectures the private sector on secure software development.

What Happened: The Full Timeline

On May 14, 2026, Guillaume Valadon, a researcher at GitGuardian, flagged a public GitHub repository called “Private-CISA.” The repository was maintained by an employee of Nightwing, a government contractor based in Dulles, Virginia, with administrative access to CISA’s code development platform.

10|

11|

Valadon described it as “the worst leak that I’ve witnessed in my career.” The repository contained:

12|

13|

14|

Plaintext AWS GovCloud admin credentials in a file literally named “Important AWS Tokens”

15|

A CSV of Firefox-saved passwords for dozens of internal CISA systems

16|

Entra ID SAML certificates

17|

Kubernetes manifests and ArgoCD application files

18|

Terraform infrastructure code

19|

GitHub Actions workflows and automation scripts

20|

Internal documentation backups, including OneNote exports

21|

CI/CD build logs detailing how CISA builds, tests, and deploys software

22|

23|

24|

The total exposure was 844 MB across the working tree and Git history. GitGuardian reported it to CERT/CC on May 14 at 4:14 PM CET. Their automated Good Samaritan program had already sent nine emails to the commit author by May 13 with no response. Valadon eventually contacted Brian Krebs to escalate directly to CISA. The repository went offline around 6:00 PM EST on May 15 — approximately 26 hours after direct contact.

25|

26|

Six months of exposure. Eight hundred and forty-four megabytes of infrastructure secrets. From the agency whose entire mandate is preventing exactly this.

Date	Event
November 13, 2025	Private-CISA GitHub repository created by Nightwing contractor
May 13, 2026	GitGuardian’s Good Samaritan program sends 9 emails to commit author — no response
May 14, 2026	GitGuardian detects the leak, reports to CERT/CC at 4:14 PM CET
May 15, 2026	KrebsOnSecurity escalates to CISA directly; repo taken offline ~6:00 PM EST
May 17, 2026	Exposed AWS GovCloud keys still valid — 48 hours after repo takedown
May 18, 2026	KrebsOnSecurity publishes initial report; congressional letters follow
May 20, 2026	TruffleHog creator finds RSA private key still active; CISA invalidates after notification

27|

28|

How the Contractor Disabled Every Built-in Safeguard

29|

30|

The most damning detail isn’t the leak itself — it’s the deliberateness behind it. According to Krebs on Security, commit logs show the CISA contractor explicitly disabled GitHub’s default push protection, the feature that blocks users from publishing SSH keys and other secrets in public repositories.

31|

32|

This wasn’t an accident. It was a conscious decision to suppress the warnings that would have caught the exposure in real time. The repository functioned as a personal scratchpad — the contractor used it as a synchronization mechanism between environments, mixing CISA-associated and personal email addresses across commits.

33|

34|

Philippe Caturegli, founder of security consultancy Seralys, validated that the exposed credentials could authenticate to three AWS GovCloud accounts at a high privilege level. He also confirmed access to CISA’s internal “artifactory” — the repository of all code packages used to build software. As Caturegli noted, that would be a prime target for a supply-chain attacker: backdoor a package once, and every new CISA software build deploys it automatically.

35|

36|

Remediation Was Dangerously Slow

37|

38|

Taking the repository offline was the easy part. Invalidating the exposed credentials proved far slower — and far more concerning.

39|

40|

According to Krebs on Security’s follow-up reporting, the exposed AWS keys remained valid for 48 hours after the repository was taken down. Worse, on May 20 — five days after the initial disclosure — Dylan Ayrey, creator of the TruffleHog secret-scanning tool, found that CISA still hadn’t invalidated an RSA private key that granted access to a GitHub app installed on the CISA-IT organization with full access to all code repositories.

41|

42|

An attacker with that key could have:

43|

44|

45|

Read source code from every repository in the CISA-IT organization, including private repos

46|

Registered rogue self-hosted runners to hijack CI/CD pipelines

47|

Accessed repository secrets and modified branch protection rules, webhooks, and deploy keys

48|

Maintained persistent access across CISA’s entire software delivery pipeline

49|

50|

51|

CISA invalidated the RSA key only after KrebsOnSecurity notified them about Ayrey’s findings on May 20. A week after the initial report, the agency was still working to invalidate and replace many of the exposed secrets. For the agency that regularly publishes guidance on secure software development, the incident response timeline is difficult to reconcile.

52|

53|

Congress Demands Answers Amid CISA’s Staffing Crisis

54|

55|

The political fallout was immediate. Senator Maggie Hassan (D-NH) sent a letter to CISA’s Acting Director Nick Andersen on May 19, demanding answers to a dozen questions about the breach. Representative Bennie Thompson (D-MS), ranking member on the House Homeland Security Committee, co-signed a letter with Rep. Delia Ramirez (D-IL) warning that the leaked files “provided the information, access, and roadmap” for adversaries like China, Russia, and Iran to penetrate federal networks.

56|

57|

As CyberScoop reported, the incident occurred against a backdrop of severe institutional degradation at CISA. The agency has lost more than a third of its workforce and nearly all of its senior leaders since the beginning of the second Trump administration, through a combination of forced early retirements, buyouts, and resignations. The lawmakers explicitly raised concerns that the leak “reflects a diminished security culture and/or an inability for CISA to adequately manage its contract support.”

58|

59|

CISA’s official response was predictably anodyne: “Currently, there is no indication that any sensitive data was compromised as a result of this incident.” This is the standard breach-response formulation — technically defensible because detecting compromise from a six-month credential exposure requires forensic analysis the agency may not have completed. It is not reassuring.

60|

61|

What This Means for Cloud Security Teams

62|

63|

If the lead federal cybersecurity agency can’t prevent a contractor from disabling secret scanning and pushing plaintext credentials to a public repo for six months, every organization should be asking hard questions about its own exposure. Here’s what this incident reinforces:

64|

65|

Secrets scanning must be non-negotiable and non-disable-able

66|

67|

GitHub’s push protection and secret scanning are free for public repositories and available for enterprise accounts. This leak was only possible because a contractor disabled the feature at the repository level. Organizations should enforce push protection at the organization level, removing the ability for individual contributors to opt out. If your developers can disable secret scanning, you don’t have secret scanning — you have security theater.

68|

69|

Contractor access needs the same controls as employee access

70|

71|

The Nightwing contractor had administrative access to CISA’s code development platform with apparently no oversight of how they managed credentials outside that platform. Third-party risk isn’t just about compliance questionnaires — it’s about verifying that contractors follow the same security hygiene standards, especially when they have privileged access to production infrastructure.

72|

73|

Credential rotation velocity matters more than detection speed

74|

75|

GitGuardian detected the leak quickly once the repository appeared on their radar. But the real failure was the 48-hour window where AWS keys stayed valid after takedown, and the five-day window where an RSA private key with full CISA-IT access remained active. Automated credential rotation — triggered by secret exposure events — should be a baseline control for any organization running in the cloud. Every hour between exposure and rotation is an hour an adversary could have cloned the repo and authenticated.

76|

77|

Git history is forever

78|

79|

Even after the repository was deleted, any clone made during the six-month exposure window retains the full history. All exposed credentials must be treated as permanently compromised regardless of repository takedown. There is no “undeleting” a secret from the internet.

80|

81|

FAQ

82|

83|

What was the Private-CISA GitHub repository?

84|

85|

Private-CISA was a public GitHub repository created on November 13, 2025 by a CISA contractor employed by Nightwing. Despite its name, the repository was publicly accessible and contained 844 MB of sensitive CISA infrastructure data, including AWS GovCloud admin keys, plaintext passwords, SAML certificates, Kubernetes manifests, Terraform code, and CI/CD build logs. It was discovered by GitGuardian on May 14, 2026 and taken offline on May 15, 2026.

86|

87|

Who discovered the CISA GitHub leak?

88|

89|

GitGuardian researcher Guillaume Valadon identified the exposed repository through the company’s automated public code scanning. Philippe Caturegli of Seralys independently validated that the exposed AWS GovCloud credentials were still active. Dylan Ayrey, creator of TruffleHog, later discovered that CISA had not yet revoked an RSA private key granting full access to the agency’s GitHub organization — five days after initial disclosure.

90|

91|

How long were CISA credentials exposed on GitHub?

92|

93|

Approximately six months. The Private-CISA repository was created on November 13, 2025 and remained publicly accessible until May 15, 2026. During that period, any internet user could have cloned the repository and obtained credentials for CISA’s AWS GovCloud infrastructure, internal systems, and software supply chain. CISA has not confirmed whether any unauthorized access occurred during the exposure window.

94|

95|

What is CISA doing to prevent future leaks?

96|

97|

CISA stated it is “working to ensure additional safeguards are implemented to prevent future occurrences” but has not publicly detailed specific technical measures. Congress has demanded a briefing on the incident, and lawmakers are pressing for answers about the agency’s oversight of contractor security practices. The agency is simultaneously dealing with a significant staffing shortage, having lost over a third of its workforce in recent months.

98|

99|