AWS access keys publicly exposed and still valid
Data Leak
Summary
Hide ▲
Show ▼
More than 9,300 AWS access keys exposed in public sources between August 2022 and August 2026 remained active and valid, creating a live risk of cloud account takeover. The exposed set included company-linked keys, AWS root keys, and AdministratorAccess credentials. Working keys could let attackers access data, change infrastructure, create persistent admin access, or deploy cryptominers.
Related Happenings
CISA contractor GitHub repository exposed internal credentials
Data Leak
H score28
First: 18.05.2026 23:48
Last: 18.05.2026 23:48
Sources 1
About this happening:
A CISA contractor left a public GitHub repository exposing AWS GovCloud credentials, plaintext passwords, and other internal access material tied to CISA and *...
CISA contractor GitHub repository exposed internal credentials
Data LeakAbout this happening: A CISA contractor left a public GitHub repository exposing AWS GovCloud credentials, plaintext passwords, and other internal access material tied to CISA and *...
Latest development: 10.07.2026 19:00
CISA said that within moments of receiving information about internal AWS GovCloud keys and other material in a public GitHub repository owned by a contractor, its Office of the Chief Information Officer took swift and comprehensive action to mitigate exposure to CISA cloud resources and code repositories. The agency said internal incident response began on May 15, no customer or mission data was exposed, and the leaked credentials were not used outside CISA's environments.
Victim organization's AWS environment hit by data theft breach
Incident
H score36
First: 11.03.2026 09:31
Last: 11.03.2026 09:31
Sources 1
About this happening:
UNC6426 breached a victim organization's AWS environment and escalated to administrator access in less than 72 hours, creating immediate risk of data theft and...
Victim organization's AWS environment hit by data theft breach
IncidentAbout this happening: UNC6426 breached a victim organization's AWS environment and escalated to administrator access in less than 72 hours, creating immediate risk of data theft and...
N8n sandbox escape flaws (multiple vulnerabilities)
Vulnerability
H score41
First: 04.02.2026 15:00
Last: 04.02.2026 15:00
Sources 1
About this happening:
Two maximum-severity sandbox-escape flaws in n8n expose self-hosted and cloud instances to complete server takeover and credential theft. An authenticated us...
N8n sandbox escape flaws (multiple vulnerabilities)
VulnerabilityAbout this happening: Two maximum-severity sandbox-escape flaws in n8n expose self-hosted and cloud instances to complete server takeover and credential theft. An authenticated us...
Publicly exposed training apps as recurring cloud-entry risk across security vendors
Trend
H score17
First: 21.01.2026 16:00
Last: 21.01.2026 16:00
Sources 1
About this happening:
Cybersecurity training apps left exposed on the public Internet are creating a recurring cloud-entry risk for security vendors and enterprise users. A scan identified...
Publicly exposed training apps as recurring cloud-entry risk across security vendors
TrendAbout this happening: Cybersecurity training apps left exposed on the public Internet are creating a recurring cloud-entry risk for security vendors and enterprise users. A scan identified...
AWS CodeBuild ACTOR_ID regex bypass security flaw
Vulnerability
H score33
First: 15.01.2026 21:31
Last: 15.01.2026 21:31
Sources 1
About this happening:
AWS CodeBuild's ACTOR_ID regex filters were misconfigured, allowing a build-trigger bypass that could expose privileged GitHub tokens and enable repository takeover. The f...
AWS CodeBuild ACTOR_ID regex bypass security flaw
VulnerabilityAbout this happening: AWS CodeBuild's ACTOR_ID regex filters were misconfigured, allowing a build-trigger bypass that could expose privileged GitHub tokens and enable repository takeover. The f...
Timeline
-
21.08.2026 18:55 2 articles · 1h ago
Truffle Security finds more than 9,300 exposed AWS access keys still active
Initial DisclosureTruffle Security found that more than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid. The exposed set includes 817 keys linked to companies, 526 AWS root keys, and 242 Identity and Access Management (IAM) users with the AdministratorAccess policy. Truffle Security also says 88% of 10,616 reverified keys continued to authenticate as of August 10, that Hugging Face was the largest single source of leaked AWS keys at 8,482 unique exposures, and that the oldest sampled key dates back 17.4 years.
Show sources
- Hundreds of leaked AWS keys give full control over corporate accounts — www.bleepingcomputer.com — 21.08.2026 18:55
- Hundreds of leaked AWS keys give full control over corporate accounts — www.bleepingcomputer.com — 21.08.2026 18:55