CISA Credential Leak Exposes AWS Govcloud Keys in Public GitHub Repository

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem analysis regarding a significant credential leak involving internal agency keys. According to reporting by KrebsOnSecurity, a contractor for CISA accidentally published dozens of internal credentials, including AWS Govcloud keys, to a public GitHub repository. The repository remained publicly accessible for nearly six months before being discovered by external researchers.

KrebsOnSecurity reported that the leak was identified in July 2026, prompting CISA to publish a detailed postmortem examining the incident. The exposure included sensitive cloud credentials that could potentially grant access to government AWS Govcloud environments. The length of exposure -- approximately six months -- has raised concerns among security experts about the agency's secret management practices and internal access controls.

The postmortem, issued on July 13, 2026, outlines the circumstances that led to the credentials being published and identifies gaps in CISA's initial response. Security analysts note that the incident provides broader lessons for security teams regarding the detection and prevention of accidental credential exposure in code repositories.

As of the postmortem publication, CISA had not confirmed whether the exposed credentials had been actively exploited, though the six-month exposure window presents a potential risk of misuse by threat actors who may have discovered the keys during that period.