More than 10,000 Docker Hub container images uploaded in November 2025 were found exposing sensitive data, including live credentials to production systems, CI/CD databases, and API keys for popular AI models.
The leaks affect just over 100 organizations, ranging from small software vendors to a Fortune 500 company and a major national bank, underscoring how common – and dangerous – secret sprawl inside container images has become.
10,456 Docker images with exposed keys
In a scan of container images uploaded to Docker Hub between November 1 and November 30, threat intelligence company Flare identified 10,456 images that contained one or more exposed keys.
Docker Hub is the world’s largest container registry, where developers upload, host, share, and distribute ready-to-use Docker images that package everything an application needs to run. These images are meant to streamline development and deployment – but as prior research has shown, careless image-building practices can accidentally ship long-lived secrets to a public registry, where they may remain valid for months or years.
AI model keys dominate exposed secrets
Among the exposed data, Flare found that access tokens for AI providers were especially common. The researchers counted almost 4,000 keys for AI and LLM services, including OpenAI, HuggingFace, Anthropic, Gemini, and Groq.
When examining the leaked images more closely, Flare discovered that 42% of them exposed at least five sensitive values each. That means many images didn’t just leak a single token, but a bundle of secrets that attackers could chain together for deeper access.
“These multi-secret exposures represent critical risks, as they often provide full access to cloud environments, Git repositories, CI/CD systems, payment integrations, and other core infrastructure components,” Flare notes in its report.
101 companies identified – including finance and banking
By analyzing 205 Docker Hub namespaces involved in the leaks, Flare was able to link 101 organizations to exposed secrets. Most of them operate in the software development sector, followed by companies in marketing and industrial segments, and firms working in AI and intelligent systems.
The dataset wasn’t limited to small players. It included at least one Fortune 500 company and a major national bank. Based on Flare’s sector breakdown, at least ten finance and banking companies appear to have had sensitive data exposed.
For attackers, that combination of exposed API keys, cloud credentials, and financial-sector targets is particularly attractive. With the right token, a malicious actor could query sensitive AI models, pivot into corporate infrastructure, or access payment-related integrations.
How secrets end up inside Docker images
Flare’s analysis highlights a few recurring mistakes that keep surfacing in public images:
- .env files baked into images
One of the most frequent errors was developers leaving.envfiles inside their containers. These files often store database credentials, cloud access keys, tokens, and other authentication data that should never leave trusted environments. - Hardcoded API keys in application code and configs
The researchers found API tokens for AI services hardcoded directly into Python files,config.jsonfiles, YAML configs, and other application configuration files. They also spotted GitHub tokens and credentials for multiple internal environments committed straight into the image. - Secrets in image manifests and build metadata
Some sensitive data appeared in the manifest of Docker images – metadata that describes the image layers and configuration. Because manifests are publicly accessible on Docker Hub, any secrets embedded there are effectively exposed to the world.
Together, these mistakes create a large, searchable surface area for attackers who systematically scan public registries for leaked credentials.
Shadow IT is making the problem worse
Many of the leaks did not come from centrally managed, official corporate Docker Hub orgs. Instead, they appeared to originate from “shadow IT” accounts – personal or contractor-owned Docker Hub accounts that fall outside normal corporate monitoring and security controls.
These accounts might be used for side projects, quick proofs of concept, or ad hoc testing, but developers often reuse real production credentials or tokens out of convenience. When those images are made public, the secrets go with them, and security teams may have no visibility into the exposure.
Developers clean up images, but not the keys
Flare also looked at how quickly developers reacted once secrets were exposed. Roughly 25% of developers who accidentally leaked secrets on Docker Hub removed the sensitive values from the container image or manifest within about 48 hours.
However, in most of these cases, the underlying keys were never actually revoked. In other words, the secret disappeared from the image, but the credential itself remained valid.
That creates a dangerous illusion of safety: anyone who scraped or stole the key while it was exposed can continue using it to mount attacks long after the image has been “fixed.”
What organizations should do now
Flare’s report closes with a familiar but urgent set of recommendations for development teams and security leaders:
- Never store secrets in container images
Treat images as artifacts that may eventually become public. Secrets belong in environment variables, orchestrator configs (like Kubernetes secrets), or dedicated secret stores – not baked into Docker layers. - Stop using static, long-lived credentials
Prefer short-lived, scoped tokens with automatic rotation. The shorter the lifetime, the smaller the blast radius when something leaks. - Centralize secrets management
Use a dedicated vault or secrets manager so teams don’t juggle credentials in ad hoc files and scripts. Centralization also makes it easier to audit and rotate keys. - Implement continuous scanning in the SDLC
Add automated secret scanning across source code, build pipelines, and container registries. Don’t limit checks to Git – scan images before they are pushed and regularly rescan what’s already in the registry. - Revoke first, then clean up
The moment an exposure is detected, revoke the affected keys and invalidate sessions immediately. Cleaning up the code or container image is important, but it’s not enough on its own.
As organizations accelerate their use of AI services and cloud-native tooling, the number of secrets in play keeps multiplying. Flare’s findings on Docker Hub are a reminder that the industry still has a long way to go in treating secrets as first-class, highly sensitive assets – not just another config parameter.