More than 10,000 Docker Hub container images expose data that should be protected, including live credentials to production systems, CI/CD databases, or LLM model keys. The secrets impact a little over 100 organizations, among them are a Fortune 500 company and a major national bank. Docker Hub is the largest container registry where developers upload, host, share, and distribute ready-to-use Docker images that contain everything necessary to run an application. Developers typically use Docker images to streamline the entire software development and deployment lifecycle. However, as past studies have shown, carelessness in creating these images can result in exposing secrets that remain valid for extended periods. After scanning container images uploaded to Docker Hub in November, security researchers at threat intelligence company Flare found that 10,456 of them exposed one or more keys. The most frequent secrets were access tokens for various AI models (OpenAI, HuggingFace, Anthropic, Gemini, Groq). In total, the researchers found 4,000 such keys. When examining the scanned images, the researchers discovered that 42% of them exposed at least five sensitive values. "These multi-secret exposures represent critical risks, as they often provide full access to cloud environments, Git repositories, CI/CD systems, payment integrations, and other core infrastructure components," Flare notes in a report today. Analyzing 205 namespaces enabled the researchers to identify a total of ...
Over 10,000 Docker Hub images found leaking credentials, auth keys
BleepingComputer
·Bill Toulas
·Published Dec 10, 2025
·Updated
Affected Software
1 affected component
Docker Hub
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses the discovery of over 10,000 Docker Hub images that are leaking sensitive credentials and authentication keys.
2
What security implications are discussed in relation to the leaked Docker Hub images?
The leaked credentials may compromise production systems, CI/CD pipelines, and access to various databases and AI model keys.
3
Which organizations are affected by these security leaks on Docker Hub?
The security leak impacts more than 100 organizations that use Docker Hub for container images.
4
What types of sensitive data are exposed in the affected Docker Hub images?
The exposed data includes live credentials for production systems and authentication tokens for CI/CD databases.
5
How does this incident reflect on the security practices of using Docker Hub?
This incident highlights the importance of securely managing secrets and not embedding sensitive information directly within Docker images.