DeepSeek ClickHouse database exposed without authentication
Wiz Research discovered a publicly accessible ClickHouse database belonging to DeepSeek that contained over a million lines of sensitive data including chat histories, API secrets, and backend details, with no authentication required. The researcher responsibly disclosed the issue to DeepSeek, which secured the exposure.
What happened
Wiz Research identified a publicly accessible ClickHouse database belonging to DeepSeek hosted at oauth2callback.deepseek.com:9000 and dev.deepseek.com:9000, accessible without any authentication.
The exposure contained over a million lines of log streams including chat history, secret keys, backend details, API secrets, and operational information, allowing full database control and potential privilege escalation.
Reported impact
The database exposure allowed unrestricted access to sensitive internal data, including chat histories, API secrets, and backend operational details without any authentication or defense mechanism.
Index analysis
The exposure was discovered through reconnaissance techniques that mapped DeepSeek's external attack surface, identifying internet-facing subdomains and detecting unusual open ports (8123 and 9000) that led to the ClickHouse database.
Governance controls
Wiz Research immediately and responsibly disclosed the issue to DeepSeek, which promptly secured the exposure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.