Tags / 4 posts
A Kibana dashboard with zero authentication exposed the entire Malawian credit bureau — 2.4 million full identity profiles, 49 million loan records and live application logs — to anyone who knew the IP.
A three-year-old Grafana path traversal led to a plaintext database, then to Zabbix API access, then to a full infrastructure map.
An exposed container registry with default credentials hands an attacker the entire software supply chain — images, secrets, source code.
A single unauthenticated HTTP GET returned the entire production secrets bundle for a customer-facing WhatsApp lead-generation bot — database, messaging provider, voice AI, LLM proxy and webhook secrets, all served as plain text.