Oracle Cloud Object Storage
Oracle Cloud Infrastructure (OCI) Object Storage exposes data when a bucket's "Visibility" is set to `Public`. The S3-compatible endpoint at `<namespace>.compat.objectstorage.<region>.oraclecloud.com` then serves anonymous LIST and GET.
Oracle Cloud Object Storage exposure data
The trend chart appears once at least 7 days of history accrue.
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
OCI uses a per-tenancy namespace prefix that operators sometimes treat as a secret, but it is deterministic and discoverable. A public bucket in any tenancy is fully reachable once the namespace is known.
Real-world impact
Anonymous LIST + GET on the whole bucket. Frequent finding pattern is database-export buckets left public during cloud-migration windows.
Remediation
- Set bucket visibility to `Private`; use Preauthenticated Requests (PAR) for time-limited shares.
- Enable Cloud Guard's "Public Bucket" detector for tenancy-wide alerts.
URL patterns
Oracle Cloud Object Storage buckets typically resolve under hostnames like:
namespace.compat.objectstorage.us-ashburn-1.oraclecloud.com/bucket/
Check a specific Oracle Cloud Object Storage URL
Paste any Oracle Cloud Object Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Oracle Cloud Object Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request