Unit 42 CTR: Leaked Code from Docker Registries
Summary: Unit 42's Cloud Threat Report: Spring 2020 found 941 Docker registries exposed to the internet, of which 117 were accessible without authentication, holding 2,956 repositories and 15,887 tags. Of those 117 unsecured registries, 80 allowed image pulls, 92 allowed pushes, and 7 allowed deletes, with owners identified by reverse DNS or TLS certificate cnames as research institutes, retailers, news media organizations, and technology companies.
What's compelling: Ninety-two registries accepted pushed images, meaning an attacker could replace a benign image with a backdoored one and every client that pulls from that registry becomes vulnerable on the next run.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026