CISA Contractor Leaked AWS GovCloud Keys for Six Months

A Government Cybersecurity Agency Exposes Its Own Keys

The agency the United States relies on to warn the rest of government and industry about cybersecurity failures has become the subject of one of its own. For roughly six months, a public GitHub repository called "Private-CISA" sat open on the internet, containing administrative credentials to three Amazon AWS GovCloud accounts, plaintext passwords for dozens of internal systems, SSH keys, an RSA private key, and detailed maps of how the Cybersecurity and Infrastructure Security Agency builds and deploys its software 689. The repository was traced to a contractor employed by Nightwing, a government services firm based in Dulles, Virginia, and was reportedly created on November 13, 2025, before being taken offline around May 18, 2026 69.

The discovery came from GitGuardian researcher Guillaume Valadon, whose company continuously scans public code repositories for exposed secrets. When automated alerts to the account owner went unanswered, Valadon escalated the matter through journalist Brian Krebs of KrebsOnSecurity, who first reported the story 610. Security consultant Philippe Caturegli of Seralys independently verified that the leaked AWS credentials were not just theoretical artifacts sitting in old code — they authenticated successfully at a high administrative privilege level 69.

What Was Actually Exposed

The scope of the leak, measured at roughly 844 megabytes of Git history, went well beyond a few stray passwords. Reporting identified tokens for CISA's internal JFrog Artifactory package system, Azure registry keys, Kubernetes manifests, ArgoCD application files, Terraform infrastructure-as-code, GitHub Actions workflows and personal access tokens, and Entra ID SAML certificates 8. One file was bluntly titled "importantAWStokens," while another, "AWS-Workspace-Firefox-Passwords.csv," listed plaintext usernames and passwords for internal systems, including one researchers identified as "LZ-DSO," apparently short for a Landing Zone DevSecOps environment used in secure code development 69.

Valadon, who spent nine years at France's national cybersecurity agency ANSSI before joining GitGuardian, called it the worst leak he had witnessed in his career, describing a "catalogue of unsafe practices" that included passwords stored in plain text, database backups committed directly into Git, and explicit instructions for disabling GitHub's built-in secret-scanning protections 68. That last detail proved central to how the exposure happened at all: commit logs showed the contractor had deliberately turned off the very GitHub feature designed to block accidental publication of credentials 689.

A Contractor's Personal Workaround

Investigators pieced together a plausible explanation for how such sensitive material ended up on a personal account. Caturegli suggested the contractor appeared to be using the public repository as an informal way to synchronize files between a work laptop and a home computer, given the steady stream of commits dating back to November 2025 69. Commits reportedly mixed a CISA-affiliated email address with a personal Yahoo account, a pattern Valadon said represents one of the hardest identity blind spots for security teams to monitor 8. Some of the credentials inside the repository also followed predictable conventions, such as a platform's name paired with the current year — a weak practice that would be risky even without public exposure 6.

The Response Timeline and Its Gaps

CISA has said it moved quickly once notified on May 15, 2026, taking the repository offline, disabling its development environment, resetting credentials, and revoking the contractor's access 710. Yet independent reporting found that some AWS GovCloud keys remained valid for approximately 48 hours after the repository disappeared from public view, and that an RSA private key granting access to the CISA-IT GitHub organization's private repositories stayed unrevoked for at least five days after the agency's first notification 9. Truffle Security's post-incident analysis, cited in later reporting, warned that an attacker holding that RSA key could have read source code across CISA's private repositories, hijacked CI/CD pipelines by registering rogue self-hosted runners, and altered administrative settings such as branch protections and webhooks 9.

CISA's own postmortem, published by acting CIO Preston Werntz and acting CISO Brad Libbey, acknowledged that credential rotation took longer than expected because of the complexity of the agency's systems and their interconnections with federal and industry partners 710. The agency also conceded that Valadon's firm had sent nine automated alerts about the exposure before the situation reached a person capable of acting on it, and that the eventual escalation required the researcher to try CISA's contractor email, its vulnerability disclosure platform, and finally a journalist 10.

GovCloud's Isolation Undermined From Within

The irony of the incident is sharpened by the nature of the environment involved. AWS GovCloud exists specifically to let government agencies handle Controlled Unclassified Information and other regulated workloads under frameworks like FedRAMP High and Department of Defense security requirements, using isolated regions, separate authentication systems, and citizen-only administrative access 1112. That architecture is built to prevent exactly the kind of external compromise the leak risked enabling — but no amount of infrastructure isolation protects against an authorized user voluntarily publishing working admin keys to the open internet 1112.

Congressional Pressure and Unanswered Questions

Lawmakers have since pressed CISA for a fuller accounting of the incident, and as of publication the agency had not detailed when full credential rotation would be complete or whether it opened a formal review of Nightwing's contractor practices 9. CISA's public statements have consistently maintained that there is "no indication that any sensitive data was compromised," and its forensic review concluded that leaked credentials were not used outside CISA's environments and that no mission or customer data was exposed 6710. Security researchers caution that such assurances rest on the completeness of the agency's logging during a six-month public exposure window, not on certainty that nothing was copied or tested by outside parties 9.

Lessons the Agency Is Applying to Itself

CISA's after-action report reads as an unusually candid self-critique for a federal agency. It cites effective use of zero-trust segmentation and logging as what worked, while flagging weak points including the absence of a dedicated GitHub or cloud-incident playbook, unclear channels for external researchers to report issues affecting CISA itself rather than its products, and insufficient guardrails preventing uploads to public repositories 710. The agency says it has since rotated all secrets tied to the exposed environments, tightened upload permissions, and committed to building clearer reporting pathways, including expanded use of security.txt files 710.

Separating the Breach From the AI Narrative

Some coverage framed the episode alongside a broader wave of anxiety about AI-accelerated attacks, pointing to separate developments such as OpenAI's plans to gate the most powerful cybersecurity capabilities of its upcoming Astra model behind restricted testing access after the system met the company's internal "Critical" capability threshold 24, and warnings from Pennsylvania utility executives about escalating threats to critical infrastructure 5. But nothing in the CISA disclosures indicates that artificial intelligence executed or discovered this particular breach; the exposure traces to a human contractor's file-syncing habits and disabled safeguards 79. The more accurate reading is that AI raises the stakes of incidents like this one by potentially letting attackers scan, classify, and exploit leaked credentials at far greater speed and scale than manual methods would allow — a risk multiplier layered atop conventional security failures, not a replacement for them.

Why It Matters

The episode underscores that even the country's lead cybersecurity agency remains vulnerable to the most ordinary of mistakes: plaintext secrets, disabled safety controls, and slow credential rotation. For an organization whose mission includes teaching the rest of government and industry how to avoid exactly these pitfalls, the breach serves as a stark reminder that secrets management, contractor oversight, and incident-response readiness require constant vigilance rather than assumed competence.