Before trusting Baseten with their data, security firm Strix ran autonomous scanning against the inference platform’s infrastructure. Within 25 minutes, the tool had obtained a live GitHub personal access token granting repository-level admin rights.
The token was discovered in a publicly accessible Harbor container registry at gcp-us-east4-zlw.registry.baseten.co. Strix enumerated the registry, downloaded a public image called baseten/baseten-app, and extracted the credential from the image’s build history metadata rather than from the filesystem layers themselves.
According to the report, the token belonged to the account basetenbot and had been created during a Docker build on March 3, 2023. When tested in July 2026—more than three years later—the credential still worked and granted access to multiple critical repositories:
The basetenlabs/baseten repository, containing the main source code for the inference platform. Admin and push permissions would allow an attacker to modify code that other companies depend on for running their models.
The basetenlabs/flux-cd repository, a GitOps system managing the desired state of Baseten’s production clusters. Admin access provided a direct path from the leaked build token to infrastructure changes.
The basetenlabs/homebrew-tap repository, the distribution channel for Baseten’s CLI tool. Compromise could enable supply chain attacks against developers installing the tooling.
Additional private repositories with read/write access, including a customers directory containing subdirectories named after Baseten clients.
The underlying vulnerability stemmed from a common Docker pattern: passing a GitHub token as a build argument to authenticate private dependencies. While the token was intended only for build-time use, Docker recorded the actual token value in the image’s metadata and build history. The report notes that Docker explicitly warns against this practice.
Baseten’s security team confirmed the issue as critical and rotated the token by the following afternoon. Strix did not modify any repositories or download customer data before disclosing the vulnerability. The incident illustrates how credentials can persist in container image metadata long after a build completes, even if the base filesystem is cleaned.
Key facts
- A GitHub personal access token with admin access was found in Baseten’s publicly downloadable Docker image
- The token was created in March 2023 but remained active and valid in July 2026, over three years later
- The credential granted admin and push access to Baseten’s main product repository, GitOps deployment system, and CLI distribution channel
- The token was discovered in the image’s build history metadata, not in the filesystem layers
- Strix discovered the vulnerability within 25 minutes of starting reconnaissance on Baseten’s infrastructure
- Baseten’s security team rotated the token and locked down the registry within one business day