We got admin access to Baseten's production GitHub in 25 minutes

A leaked GitHub token gave unauthorized admin access to core Baseten code and infrastructure repositories.

Security researchers at Strix discovered an active GitHub Personal Access Token (PAT) with admin and push access to Baseten's internal repositories. The token was found within a Docker image downloaded from a publicly accessible Harbor registry belonging to Baseten. This image, dated March 2023, contained the token in its build history, granting it administrative privileges over Baseten's main product repository, its GitOps repository, and its Homebrew tap, along with read/write access to several other private repositories, including those containing customer-specific data. The researchers found the token after autonomously scanning Baseten's infrastructure for vulnerabilities. Upon discovery, they immediately disclosed the finding to Baseten, whose security team confirmed the critical issue and revoked the token within 24 hours.

The discovery highlights a significant vulnerability in how sensitive credentials can persist in seemingly innocuous artifacts like Docker images. The token, embedded in build history, remained active for over three years, indicating a potential gap in credential rotation and image scanning practices for even established companies. This incident underscores the risk of supply chain attacks, where compromised build artifacts or credentials could allow attackers to tamper with code, infrastructure, or distribution channels.

This event also points to the evolving capabilities of AI-powered security tools like Strix, which can autonomously chain together multiple vulnerabilities, from exposed registries to leaked credentials in build artifacts. As AI agents become more sophisticated, their potential to both discover and exploit such flaws rapidly increases, necessitating a proactive and continuous security posture for organizations relying on third-party services or complex build pipelines.