# How a malicious pull request could expose cloud infrastructure credentials

DevFeed: [How a malicious pull request could expose cloud infrastructure credentials](<https://devfeed.tech/articles/how-to-attack-cloud-infrastructure-via-a-malicious-pull-request-29669.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/hack-via-pull-request/>)

Author: info@goteleport.com (Walt Della)

Published: 2021-09-16T00:00:00Z

Content type: article

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Pull Request](<https://devfeed.tech/topics/pull-request.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [docker](<https://devfeed.tech/tags/docker.md>), [github](<https://devfeed.tech/tags/github.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [pull-request](<https://devfeed.tech/tags/pull-request.md>), [remote-code-execution](<https://devfeed.tech/tags/remote-code-execution.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This blog post analyzes a vulnerability in Teleport's former CI environment in which code from an unapproved external pull request could escape isolation, pivot through Kubernetes workloads to CI infrastructure, and expose production AWS credentials. The article says the CI system was fixed and that the response team found no evidence of exploitation or data tampering.

## Source excerpt

In this blog post we'll explain how an attacker can get access into a cloud environment by sending a malicious pull request.