CISA Admin Exposes AWS GovCloud Credentials on GitHub

A Nightwing contractor working for the Cybersecurity and Infrastructure Security Agency (CISA) publicly exposed highly privileged AWS GovCloud credentials, plaintext passwords, and sensitive internal system files through a GitHub repository.

The Private-CISA repository remained publicly accessible from November 13, 2025 until mid-May 2026, when independent researchers alerted CISA to the exposure.

On May 15, 2026, Guillaume Valadon, a cybersecurity researcher at GitGuardian a firm that continuously scans public code repositories for exposed secrets flagged the repository after the account owner failed to respond to automated alerts.

GitGuardian’s platform automatically notifies offending accounts of apparent sensitive data exposures, but in this case no response was forthcoming.

CISA Admin Exposes AWS GovCloud Credentials

Analysis of the commit logs revealed that the contractor had deliberately disabled GitHub’s built-in secret-scanning feature, which is designed to block users from publishing SSH keys or sensitive credentials to public repositories.

“Passwords stored in plain text in a CSV, backups in git, explicit commands to disable GitHub secrets detection,” Valadon stated. “This is indeed the worst leak that I’ve witnessed in my career.”

Philippe Caturegli, founder of security consultancy Seralys, independently validated the credentials and confirmed they granted high-privilege administrative access to three AWS GovCloud accounts. The exposed assets included:

• importantAWStokens — Administrative credentials to three AWS GovCloud servers
• AWS-Workspace-Firefox-Passwords.csv — Plaintext usernames and passwords for dozens of internal CISA systems
• LZ-DSO credentials — Access to CISA’s Landing Zone DevSecOps environment, the agency’s secure code development platform
• Artifactory credentials — Access to CISA’s internal code package repository used across software build pipelines
• Weak, predictable passwords — Many credentials followed the format [platform name][current year]

Caturegli assessed that the repository was likely used as a personal sync mechanism between the contractor’s work laptop and home computer, given its consistent commit activity since November 2025.

Security experts warned that the artifactory access represents the most dangerous long-term threat vector.

A compromised software package repository could allow attackers to inject backdoors into CISA’s build pipeline, ensuring persistent access with every new software deployment.

“Backdoor some software packages, and every time they build something new, they deploy your backdoor left and right,” Caturegli warned. “That would be a prime place to move laterally.”

The repository was taken offline after KrebsOnSecurity and Seralys notified CISA; however, the exposed AWS keys inexplicably remained valid for an additional 48 hours after takedown, raising serious concerns about CISA’s credential revocation procedures.

A CISA spokesperson confirmed the agency is aware and investigating: “Currently, there is no indication that any sensitive data was compromised as a result of this incident. We are working to ensure additional safeguards are implemented to prevent future occurrences.” 

Nightwing, the Dulles, Virginia-based government contractor whose employee maintained the repository, declined to comment and directed all inquiries to CISA. The incident arrives at a particularly vulnerable moment for CISA, said KrebsOnSecurity.

The agency has shed nearly one-third of its workforce since the start of the second Trump administration dropping from approximately 3,400 employees to around 2,400 by late 2025 through a combination of forced retirements, voluntary buyouts, and resignations.

Its operational budget faces a proposed reduction of over $420 million, with cuts targeting cybersecurity operations, training programs, and the National Risk Management Center.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.