Docker Hub breach: check your build tokens
Data on 190,000 Docker Hub accounts was exposed, including GitHub and Bitbucket tokens used for automated builds.
Docker said on Friday that someone accessed a Docker Hub database with data on about 190,000 accounts: usernames, hashed passwords, and the GitHub and Bitbucket tokens used for automated builds. Docker revoked those tokens.
Those tokens can read your source code, and sometimes write to it.
What to do:
- Change your Docker Hub password, and anywhere else you used it.
- Check your GitHub and Bitbucket security logs for unexpected access or new deploy keys.
- Reconnect automated builds with fresh tokens, giving them the smallest permissions that work.
- Review which images you pull from Docker Hub, and pin them by digest.
Every service connected to your code repositories is part of your security. Keep a list, and remove the ones you no longer use.