Loading story…
Wiz researchers found publicly reachable, unauthenticated ClickHouse services tied to DeepSeek at oauth2callback.deepseek.com and dev.deepseek.com on ports 8123 and 9000. The database reportedly contained more than one million log records, including user chat histories, API secrets, backend details, and operational metadata in plaintext; its configuration also permitted full database control and created potential paths to privilege escalation or local-file access. DeepSeek secured the exposed database after responsible disclosure.
Separately, a researcher reported that a Filevine non-production demo instance exposed a Box API token through an unauthenticated recommendation endpoint identified in client-side JavaScript. The token allegedly granted administrative access to one law firm’s Box environment, where testing returned nearly 100,000 files matching “confidential”; the researcher stopped further access testing. Filevine said the issue affected a single law firm rather than its broader platform, remediated it, and confirmed resolution.
Map this exposure pattern across your cloud, code, and identities.
9 events from the most recent confirmed update back to the earliest known activity.
Filevine confirmed that it had resolved the issue. The company said the exposure was limited to a non-production environment for one law firm and was not system-wide.
The researcher followed up with Filevine to verify whether the remediation had been deployed.
Filevine's security team acknowledged the report and said it would review and quickly remediate the issue.
A researcher discovered that an unauthenticated Filevine recommendation API endpoint returned a live, fully scoped Box administrative token for one law firm's filesystem. The researcher validated the impact by searching for "confidential" and receiving nearly 100,000 results, then reported the issue to Filevine.
The researcher publicly disclosed the Filevine vulnerability, describing the unauthenticated endpoint and its exposure of a Box token capable of accessing sensitive legal documents and related data.
After reviewing the DeepSeek exposure, ClickHouse disabled network access for the default user by default in its official Docker images. The change was backported to the last three releases and two LTS versions.
DeepSeek promptly secured the exposed ClickHouse database after Wiz's disclosure.
Wiz responsibly disclosed the exposed database to DeepSeek after limiting its testing to enumeration and non-intrusive queries.
Wiz Research identified a publicly accessible, unauthenticated ClickHouse database on DeepSeek infrastructure that permitted database operations and exposed more than one million log entries, including plaintext chat history, API secrets, backend details, and operational metadata.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
alexschapiro.com
Open sourcewiz.io
Open sourcewiz.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a **critical Moltbook** exposure caused by an unauthenticated database/API access issue that allowed enumeration of agent records (e.g., `GET /api/agents/{id}`) and leakage of **email addresses, JWT `login_token`s, and third-party `api_key`s**, enabling agent hijacking and downstream abuse of connected services. Separately, **Cal.com Cloud** was found vulnerable to a chained set of broken access controls and signup/invite-token logic flaws that enabled **complete account takeover** and access to sensitive booking data (attendee details, emails, and booking histories) at scale, including organizational accounts. In parallel, SentinelLabs documented that roughly **175,000 internet-exposed Ollama** instances were reachable due to common deployment misconfiguration (binding to `0.0.0.0`/public interfaces), creating conditions for **arbitrary code execution** and access to external resources—especially where tool-calling features were enabled. A distinct IoT case study described **Molekule** air purifiers exposing fleet-wide telemetry because an **AWS Cognito Identity Pool** permitted unauthenticated access to **AWS IoT Core MQTT** subscriptions, leaking device shadow data (e.g., Wi‑Fi SSIDs, MAC addresses, device names, sensor readings) for ~100,000 devices; the disclosed policy reportedly allowed read/subscribe access but not device control without per-device certificates.
Jun 29, 2026
A critical vulnerability, **CVE-2026-82533**, in DeepSeek Harness allows attacker-influenced AI coding agents to bypass the tool’s local control-plane authentication and switch their own sessions to `danger-full-access`. The HTTP API trusted a client-supplied `Host` header instead of validating the TCP peer, enabling a sandboxed agent to reach the loopback interface, disable file-write restrictions and approval prompts, and execute privileged commands without credentials, user approval, configuration changes, or external network exposure. The flaw affects DeepSeek Harness `0.1.1-rc.2` and earlier. It can also expose stored conversations and session logs; remote attackers would require an existing port forward, tunnel, or proxy because the CLI does not bind externally by default. DeepSeek addressed the issue by adding one-time-token authentication, with fixed releases reported from `0.1.2-alpha.1` onward; organizations should update to a current patched release and review local API exposure, tunnels, proxies, and potentially compromised session data.
Sep 9, 2026
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026