Security Breach: Admin Access to Baseten's GitHub via Exposed Docker Image
A critical vulnerability exposed admin rights to Baseten's core repositories for over 3 years.
1Critical GitHub Access Exposed
Strix security researchers discovered a live GitHub personal access token with admin rights in Baseten's public Docker image. The token, embedded in a March 2023 build, granted push/admin access to core repositories including the main product repo, GitOps cluster configuration, and customer-specific directories. Despite being three years old, the credential remained active when found in July 2026, exposing critical infrastructure to potential tampering.
2How the Breach Occurred
The vulnerability stemmed from a Docker build process that passed a GitHub token as a build argument, which was then recorded in the image's metadata. The token was used to fetch private dependencies during build but remained exposed in the image's history. Docker explicitly warns against this practice, yet the credential persisted in a publicly accessible Harbor registry project, allowing anonymous pull access to the container image and its sensitive metadata.
3Scope of Compromise
The exposed token had admin access to basetenlabs/baseten (main product code), basetenlabs/flux-cd (cluster state management), and basetenlabs/homebrew-tap (CLI distribution). Most concerning was basetenlabs/fde containing customer-specific directories. This created potential supply chain attack vectors - from code tampering to infrastructure manipulation and customer data exposure - all accessible via an old build credential.
4Security Team Response
Baseten's security team responded professionally within hours, confirming the issue as critical. They locked down the registry project and rotated the compromised token by the next afternoon. The company already uses AI security tooling, highlighting how even security-conscious organizations can overlook persistent credentials in container images. Their rapid response prevented potential exploitation of the vulnerability.
5The Discovery Process
Strix, an autonomous hacking agent, found the vulnerability during routine vendor security checks before using Baseten's services. It enumerated hosts, discovered the exposed Harbor registry, pulled images anonymously, and analyzed build history without any initial credentials or source code access. The entire discovery-to-verification process took just 25 minutes, demonstrating the speed of automated security testing.
6Broader Security Implications
This incident underscores two critical security blind spots: build credential persistence and container image history inspection. Many teams focus on scanning image filesystems while neglecting build metadata. The case also shows how old credentials in deprecated systems can create backdoors, emphasizing the need for comprehensive credential lifecycle management beyond just rotating current tokens.
7Preventive Measures
The secure alternative involves using BuildKit secret mounts for temporary authentication that doesn't persist credentials. Organizations must inspect both image layers and build history, revoke old tokens, and avoid saving authenticated URLs in global Git config. Regular black-box testing of public-facing assets is crucial, as the most severe vulnerabilities often exist in forgotten subdomains or services.
8AI's Role in Security
This discovery demonstrates both the promise and peril of AI in cybersecurity. Autonomous agents like Strix can uncover complex vulnerabilities rapidly, but malicious AI could follow the same paths. As AI-powered attacks become more sophisticated, continuous self-testing becomes essential. The 25-minute discovery window shows how quickly automated systems can identify and exploit such vulnerabilities.