I Found 39 Algolia Admin Keys Exposed Across Open Source Documentation Sites

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

39 Exposed Algolia Admin Keys Threaten Major Open Source Projects A cybersecurity researcher discovered 39 exposed Algolia admin API keys across various open source documentation sites. The keys, which were supposed to be read-only, had full permissions, allowing potential attackers to manipulate or delete indexed content. The researcher identified these keys by scraping approximately 15,000 documentation sites and analyzing GitHub repositories. Affected projects include popular ones like Assistant, KEDA, and vcluster, with some keys still active despite notifications sent to Algolia. The researcher reported the findings to Algolia, but as of today, no response has been received, and the keys remain active. This incident highlights a broader issue of misconfiguration in the use of Algolia's DocSearch service, which is intended to provide read-only access. The researcher warns that the actual number of exposed keys could be much higher, given the ease of finding them. Immediate action is recommended for organizations using Algolia's service to verify their API key configurations. 2 sources 71