deepseek-ai/DeepSeek-V3
1
0
Fork 0
mirror of https://github.com/deepseek-ai/DeepSeek-V3.git synced 2026-11-05 00:47:48 +00:00
Code Issues 25 Projects Packages Wiki Activity

[GH-ISSUE #1344] 🔴 [Security] Internal Infrastructure IPs Leaked in Public DNS — Grafana, GitLab, W&B, ArgoCD #886

New issue
Closed
opened 2026-10-26 21:31:42 +00:00 by bsakaguchi · 3 comments
bsakaguchi commented 2026-10-26 21:31:42 +00:00
Owner
Copy link

Originally created by @k4w-wak on GitHub (May 22, 2026).
Original GitHub issue: https://github.com/deepseek-ai/DeepSeek-V3/issues/1344

🔴 CRITICAL: Internal Infrastructure IPs Leaked in Public DNS

Summary

Multiple internal infrastructure subdomains of deepseek.com resolve to RFC1918 private IP addresses, revealing the entire internal infrastructure stack including GitLab, Grafana, W&B (Weights & Biases), and ArgoCD.

Evidence

RFC1918 IPs in Public DNS:

$ dig grafana.deepseek.com A
grafana.deepseek.com. 300 IN A 10.2.201.57

$ dig gitlab.deepseek.com A
gitlab.deepseek.com. 300 IN A 10.2.201.57

$ dig wandb.deepseek.com A
wandb.deepseek.com. 300 IN A 10.2.201.57

$ dig argocd.deepseek.com A
argocd.deepseek.com. 300 IN A 172.30.2.240

Additional Subdomain Leaks:

  • chat-test.deepseek.com → Feishu OAuth app_id=cli_a77534d68d585013 leaked in redirect
  • api-test.deepseek.com → d3ub412kzjxop6.cloudfront.net (test API on CloudFront)
  • nrjcdfbfcn5ehj5-dev.deepseek.com → Huawei Cloud WAF instance ID exposed
  • nrjcdfbfcn5ehj5-test.deepseek.com → Huawei Cloud WAF instance ID exposed
  • feedback.deepseek.com → Huawei Cloud WAF instance ID exposed

Impact

  1. Complete infrastructure mapping — Internal services revealed: GitLab (source code), Grafana (monitoring), W&B (ML experiments), ArgoCD (k8s deployments)
  2. Single point of failure — All 3 services share IP 10.2.201.57, likely a single server/cluster
  3. Feishu OAuth app_id leaked — Could be used for phishing attacks against DeepSeek employees
  4. Huawei Cloud WAF instance IDs exposed — Reveals cloud provider and WAF infrastructure details
  5. Test/dev infrastructure publicly accessible — CloudFront distributions for test environments

Recommended Fix

  1. Remove RFC1918 A records from public DNS — these should only resolve internally
  2. Use internal DNS zones (e.g., grafana.internal.deepseek.com or split-horizon DNS)
  3. Remove Feishu app_id from public redirects
  4. Restrict Huawei Cloud WAF instance IDs from public DNS
  5. Consider using DNS zone transfers restrictions

Evidence Gist

https://gist.github.com/k4w1992-lgtm/55cac0090c1394b4ec7d263bab8c3854

Originally created by @k4w-wak on GitHub (May 22, 2026). Original GitHub issue: https://github.com/deepseek-ai/DeepSeek-V3/issues/1344 ## 🔴 CRITICAL: Internal Infrastructure IPs Leaked in Public DNS ### Summary Multiple internal infrastructure subdomains of `deepseek.com` resolve to RFC1918 private IP addresses, revealing the entire internal infrastructure stack including GitLab, Grafana, W&B (Weights & Biases), and ArgoCD. ### Evidence **RFC1918 IPs in Public DNS:** ```bash $ dig grafana.deepseek.com A grafana.deepseek.com. 300 IN A 10.2.201.57 $ dig gitlab.deepseek.com A gitlab.deepseek.com. 300 IN A 10.2.201.57 $ dig wandb.deepseek.com A wandb.deepseek.com. 300 IN A 10.2.201.57 $ dig argocd.deepseek.com A argocd.deepseek.com. 300 IN A 172.30.2.240 ``` **Additional Subdomain Leaks:** - `chat-test.deepseek.com` → Feishu OAuth `app_id=cli_a77534d68d585013` leaked in redirect - `api-test.deepseek.com` → d3ub412kzjxop6.cloudfront.net (test API on CloudFront) - `nrjcdfbfcn5ehj5-dev.deepseek.com` → Huawei Cloud WAF instance ID exposed - `nrjcdfbfcn5ehj5-test.deepseek.com` → Huawei Cloud WAF instance ID exposed - `feedback.deepseek.com` → Huawei Cloud WAF instance ID exposed ### Impact 1. **Complete infrastructure mapping** — Internal services revealed: GitLab (source code), Grafana (monitoring), W&B (ML experiments), ArgoCD (k8s deployments) 2. **Single point of failure** — All 3 services share IP `10.2.201.57`, likely a single server/cluster 3. **Feishu OAuth app_id leaked** — Could be used for phishing attacks against DeepSeek employees 4. **Huawei Cloud WAF instance IDs exposed** — Reveals cloud provider and WAF infrastructure details 5. **Test/dev infrastructure publicly accessible** — CloudFront distributions for test environments ### Recommended Fix 1. Remove RFC1918 A records from public DNS — these should only resolve internally 2. Use internal DNS zones (e.g., `grafana.internal.deepseek.com` or split-horizon DNS) 3. Remove Feishu app_id from public redirects 4. Restrict Huawei Cloud WAF instance IDs from public DNS 5. Consider using DNS zone transfers restrictions ### Evidence Gist https://gist.github.com/k4w1992-lgtm/55cac0090c1394b4ec7d263bab8c3854
bsakaguchi 2026-10-26 21:31:42 +00:00
bsakaguchi commented 2026-10-26 21:31:43 +00:00
Author
Owner
Copy link

@qingkong66 commented on GitHub (May 24, 2026):

@k4w1992-lgtm

Report acknowledged. This is a clear infrastructure leak — internal subdomains resolving to RFC1918 IPs, plus Feishu OAuth app_id exposed.

The issue has been reported to the DeepSeek security team via email. No public technical discussion here.

Thanks for the detailed DNS evidence and responsible disclosure.

<!-- gh-comment-id:4529092472 --> @qingkong66 commented on GitHub (May 24, 2026): @k4w1992-lgtm Report acknowledged. This is a clear infrastructure leak — internal subdomains resolving to RFC1918 IPs, plus Feishu OAuth app_id exposed. The issue has been reported to the DeepSeek security team via email. No public technical discussion here. Thanks for the detailed DNS evidence and responsible disclosure.
bsakaguchi commented 2026-10-26 21:31:43 +00:00
Author
Owner
Copy link

@github-actions[bot] commented on GitHub (Jul 6, 2026):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this issue is still relevant, please leave a comment to keep it open. Thank you for your contributions!

<!-- gh-comment-id:4888198969 --> @github-actions[bot] commented on GitHub (Jul 6, 2026): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this issue is still relevant, please leave a comment to keep it open. Thank you for your contributions!
bsakaguchi commented 2026-10-26 21:31:43 +00:00
Author
Owner
Copy link

@github-actions[bot] commented on GitHub (Aug 2, 2026):

false

<!-- gh-comment-id:5154214297 --> @github-actions[bot] commented on GitHub (Aug 2, 2026): false
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
v1.0.0
Labels
Clear labels   
closed-as-stale

   
enhancement

   
question

   
spam

   
stale
No labels
closed-as-stale
enhancement
question
spam
stale
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
deepseek-ai/DeepSeek-V3#886
No description provided.