Tencent Cloud’s Misconfiguration Exposed Internal Source Code and Credentials

Cybersecurity researchers from CYBERNEWS recently published a report detailing a serious misconfiguration at Tencent Cloud that exposed internal source code environments and credentials to the public internet. The exposed assets could have given attackers full access to Tencent Cloud’s internal services and backend infrastructure, with data tied to both testing and production environments left publicly accessible and at risk of automated harvesting.

The incident did not directly affect Tencent Cloud customers, as account credentials and personal data remained secure, but researchers warned that attackers could exploit the leaked internal service data to launch broader attacks. Affected services included Tencent Cloud’s internally used load balancers and deployments of JEECG, an open‑source development platform promoted by Tencent Cloud, with files containing hard-coded plaintext passwords and sensitive internal .git directories.

According to CYBERNEWS researchers, if the data had fallen into the wrong hands, the passwords could be used to gain direct access to Tencent Cloud’s management console and potentially take control of backend infrastructure and internal services; the issue was first detected during an internet-wide scan in late July 2025, and historical evidence suggests the servers had been publicly exposed since at least April 2025 before remediation.