ClosedPatched
DeepSeek leaves ClickHouse database open: chat logs and API keys exposed
DeepSeek backend (ClickHouse)
Wiz found two DeepSeek ClickHouse instances open to the internet without authentication. Its query interface allowed arbitrary SQL and exposed a log_stream table with over a million entries, including plaintext chat history, API keys and backend details. DeepSeek locked it down within an hour of being told.
Why this severity: Unauthenticated database exposure; chat logs and secrets
- Started
- Jan 29, 2025
- Closed
- Jan 29, 2025
Affected
- n/a
Fixed in
- Database secured by DeepSeek
Timeline1
Wiz finds the exposed database and reports it; DeepSeek secures it within an hour
Source
News & write-ups4
- Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive InformationWiz · Jan 29, 2025 · Write-up
- Sensitive DeepSeek data exposed to web, cyber firm saysReuters · Jan 29, 2025
- DeepSeek exposes database with over 1 million chat recordsBleepingComputer
- Exposed DeepSeek Database Revealed Chat Prompts and Internal DataWIRED
Get an email when a new major security incident drops. No spam, unsubscribe any time.
