Tia N.List

Reported by 2 outlets

GitHub App Private Keys: 474 Leaked Keys Exposed

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.00 / 2.0 · best outlet weight
Severity
0.80 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.54 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
blog.gitguardian.comsecurityonline.info first seen 21d ago

Analysis

GitGuardian found 474 leaked GitHub App private keys still active out of 4,802 tested, representing about 10% of exposed keys. These authenticated as 440 distinct Apps; 44 had full organization admin access, 72% could read private repositories, and 207 could write to repositories. The keys never expire. The event names exposed keys for GitHub Actions, BuildBuddy, Crusher.dev, and the CDC. A single compromised App can reach every repository it covers and potentially take over the organization.

Why it matters: exposed App keys are a persistent supply-chain vector, not a transient leak. Because the keys do not expire, forgotten leaks remain valid for years. Organizations with leaked keys that have write or admin access face full repository and organizational takeover.

Watch for rotation campaigns targeting these 474 keys and any follow-up reports linking specific leaked keys to observed abuse in CI/CD pipelines.

Timeline

  1. original reporting

    GitHub App Private Keys: 474 Leaked Keys Exposed

    blog.gitguardian.com · 21d ago · September 22nd, 2026

    TL;DR 474 of 4,802 tested keys still worked: GitGuardian pulled these from over 500,000 exposed RSA keys and found 474, about 10%, still authenticating as 440 distinct Apps on GitHub's API. 44 Apps had full organization admin access: 72% of the compromised Apps could read private repository content, and 207 could write to it, turning one leaked key into an organization takeover. GitHub App keys never expire: Real cases included Access Tokens for GitHub Actions, BuildBuddy, Crusher.dev, and the CDC, where a forgotten leak can grant access for years until someone rotates it. Supply-chain security has been a hot topic in recent years. Threat actors have exploited the npm, PyPI, and Rust ecosystems to compromise developer machines at scale, and GitHub has played a central role as an entry point through badly configured Action workflows. GitHub Apps are a lesser-explored vector in that same landscape. Because of the privileges they hold, they are one of the most sensitive components in the GitHub ecosystem, capable of reaching into every repository an installation covers and, in the worst cases, taking over the organizations that installed them. The recent CISA leak showed exactly how far that reach can go: a single compromised App became an open door into the organization's information system. In this article, we look at how GitHub Apps authenticate, and what happens when their private keys fall into the wrong hands. What is a GitHub App? GitHub Apps are a GitHub platform feature

  2. update from blog.gitguardian.com

    Leaked GitHub App private keys let researchers impersonate 440 apps including CDC and BuildBuddy

    blog.gitguardian.com · 21d ago · September 22nd, 2026

    A large-scale scan for leaked GitHub App private keys turned up some nice numbers, summarized below. Out of 5,000 leaked private keys tied to GitHub App environments, 474 were still valid at time of analysis. Those keys could impersonate 440 different GitHub Apps, some with high-level permissions (repo access, org-level admin, etc.). A subset reportedly could have allowed takeover of private repositories or entire GitHub organizations. Affected entities included the US CDC and BuildBuddy , plus some widely used GitHub Actions. Responsible disclosure got mixed results: most responses were slow or nonexistent, and most of the keys were reportedly still active as of publication. CDC took about two weeks to rotate their key, despite it reportedly having a path to code execution in their Azure

    via reddit r/cybersecurity: Leaked GitHub App private keys let researchers impersonate 440 apps including CDC and BuildBuddy

  3. update from securityonline.info

    GitGuardian discovered 474 leaked GitHub App private keys still active. Learn how exposed GitHub App private keys threaten organizations lik

    securityonline.info · 20d ago · September 23rd, 2026

    Learn how exposed GitHub App private keys threaten organizations lik

    via Mastodon https://securityonline.info/github-app-private-keys-leak/?utm_source=mastodon&utm_medium=jetpack_social

Source on GitHub