Linode Object Storage
Linode Object Storage is S3-compatible and hosted on `<region>.linodeobjects.com`. Exposure happens when a bucket is created with the "public-read" ACL preset.
Linode Object Storage exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
Linode's CLI accepts `--acl-public` as a single-flag toggle. Set it once during a deploy script and the bucket stays world-readable indefinitely, with no separate "listing" knob.
Real-world impact
Public ACL implies both `ListBucket` and `GetObject` for unauthenticated callers. The bucket behaves identically to a public S3 bucket.
Remediation
- Recreate the bucket without `--acl-public` and migrate objects.
- Use Linode's presigned-URL flow for short-lived public access instead.
URL patterns
Linode Object Storage buckets typically resolve under hostnames like:
example.us-east-1.linodeobjects.comexample.eu-central-1.linodeobjects.com
Check a specific Linode Object Storage URL
Paste any Linode Object Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Linode Object Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request