CISA contractor exposes internal credentials on public GitHub

Source:Krebs on Security

02 — Who / Subject

CISA (Cybersecurity & Infrastructure Security Agency)

03 — Where / Locus

United States

04 — When / Temporality

May 22, 2026

Verified: May 22, 2026

05 — Why / Core Summary

"A CISA contractor created a public GitHub repository 'Private-CISA' containing plaintext credentials for internal systems. Lawmakers are demanding answers regarding security lapses and the agency's ability to manage contractors. CISA is working to invalidate the leaked keys, though some remained active for weeks after initial notification."

Conflict Analysis

This incinformationnt highlights significant vulnerabilities in supply chain security and internal credential management within a critical federal agency.

Recommended Background Resource

Affiliate / AdAI Curation

This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

Author: Nicole Perlroth

This book provides a deep dive into the vulnerabilities of government systems and the global cyber-arms race, illustrating how easily sensitive credentials and exploits can leak, which is highly relevant to the CISA contractor incident.

Explore Background Book (Amazon)

As an Amazon Associate, COMPAMIR earns from qualifying purchases.

Post