Curated threat intel for security leaders
identity 2026-08-19

Cloud providers' metadata API exposed to public internet

Cloud providers like AWS expose a public REST API to retrieve machine-specific data, including sensitive information that can be accessed by unauthorized parties.

Bottom line: Unauthorized access to this API could result in sensitive data being compromised.

What's happening: AWS provides a public REST API at 169.254.169.254 that allows code running on virtual machines to retrieve machine-specific data, including MAC addresses and IP addresses, for over 200,000 VMs.

What to do: Security teams should immediately monitor API traffic and implement additional security controls to restrict access to this API, such as implementing IAM policies and configuring API gateways.

Source: SANS Internet Storm Center