Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
12 findings · run finished 2026-09-12 06:04Z · worst first
HighNewEC2 instance accepts IMDSv1 <on "prod">1234567890120d
observed on synthetic accountsV-013a · f/8qMQNSkNyV · e/8K95JNg2jDnJ
CriticalEC2 instance accepts IMDSv1prod-acct · eu-central-1 / payments-prod-cluster-0‹generated-workload-48› +9156d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-48 in eu-central-1 (account 123456789012): first seen 156 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/2MABPzB2Np · e/9ABCDEFGHJKL e/GHJKLMNPQRST e/PQRSTUVWXYZa +4
CriticalEC2 instance accepts IMDSv1part of case k/cbfca6f4bf85sandbox · eu-central-1‹generated-workload-8› +456d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-8 in eu-central-1 (account 345678901234): first seen 56 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/2dTniNd4qd · e/9ABCDEFGHJKL e/GHJKLMNPQRST e/PQRSTUVWXYZa +9
HighEC2 instance accepts IMDSv1sandbox · eu-central-1‹generated-workload-98› +3146d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-98 in eu-central-1 (account 345678901234): first seen 146 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/BSjCw2wbo5 · e/KLMNPQRSTUVW e/STUVWXYZabcd e/Zabcdefghijk +9
HighEC2 instance accepts IMDSv1prod-acct · eu-central-1 / payments-prod-cluster-2‹generated-workload-18› +7126d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-18 in eu-central-1 (account 123456789012): first seen 126 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/7mD96YMg1v · e/KLMNPQRSTUVW e/STUVWXYZabcd e/Zabcdefghijk +1
HighEC2 instance accepts IMDSv1sandbox · eu-central-1‹generated-workload-38› +686d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-38 in eu-central-1 (account 345678901234): first seen 86 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/FrSNqE2JCa · e/fghijkmnopqr e/6789ABCDEFGH e/DEFGHJKLMNPQ +3
HighEC2 instance accepts IMDSv1234567890123 · eu-central-1‹generated-workload-88› +776d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-88 in eu-central-1 (account 234567890123): first seen 76 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/2dySnCctFp · e/9ABCDEFGHJKL e/GHJKLMNPQRST e/PQRSTUVWXYZa +8
HighEC2 instance accepts IMDSv1234567890123 · eu-central-1‹generated-workload-58› +546d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-58 in eu-central-1 (account 234567890123): first seen 46 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/EsNA78d342 · e/KLMNPQRSTUVW e/STUVWXYZabcd e/Zabcdefghijk +5
HighEC2 instance accepts IMDSv1prod-acct · eu-central-1 / payments-prod-cluster-2‹generated-workload-78› +46d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-78 in eu-central-1 (account 123456789012): first seen 6 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/DXc2x28NM4 · e/fghijkmnopqr e/6789ABCDEFGH e/DEFGHJKLMNPQ +7
MediumEC2 instance accepts IMDSv1sandbox · eu-central-1‹generated-workload-68› +8116d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-68 in eu-central-1 (account 345678901234): first seen 116 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/PzHuBi8RGP · e/VWXYZabcdefg e/cdefghijkmno e/3456789ABCDE +6
MediumEC2 instance accepts IMDSv1prod-acct · eu-central-1 / payments-prod-cluster-0‹generated-workload-108› +636d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-108 in eu-central-1 (account 123456789012): first seen 36 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/Hfz9XK3P2R · e/VWXYZabcdefg e/cdefghijkmno e/3456789ABCDE +1
MediumEC2 instance accepts IMDSv1234567890123 · eu-central-1‹generated-workload-28› +316d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-28 in eu-central-1 (account 234567890123): first seen 16 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/5J86YzUpUa · e/VWXYZabcdefg e/cdefghijkmno e/3456789ABCDE +2