Critical Baseten Harbor PAT Vulnerability Allowed Total GPU Cluster Compromise in Under 25 Minutes

The Three-Question Framework

What Happened?

Cloud security research firm Wiz disclosed a critical vulnerability chain (CVE-2026-38192) in Baseten's managed Harbor container registry infrastructure. The flaw allowed unauthorized attackers to extract unencrypted personal access tokens (PATs) and administrative service credentials embedded in ephemeral Docker build cache layers, achieving complete root compromise of multi-tenant GPU inference clusters within 25 minutes.

Why It Matters

Baseten powers production model inference for hundreds of leading AI enterprises, running thousands of Nvidia H100 and B200 GPU nodes. A cluster compromise of this scale would have enabled malicious actors to exfiltrate proprietary model weights, inject backdoors into production weights (weight poisoning), or siphon enterprise inference prompts containing confidential customer data.

What Could Happen Next

Baseten resolved the issue in coordination with Wiz prior to public disclosure, revoking all legacy tokens, purging intermediate container cache layers, and deploying eBPF-based kernel runtime isolation across its entire GPU fleet. No customer data or weights were observed to be exfiltrated during the audit.

Executive Key Takeaways

CVE-2026-38192 Disclosed: High-severity token exposure in Harbor container registries powering serverless model inference deployments.

25-Minute Compromise: Vulnerability chain permitted escalating from an unprivileged customer account to full administrative cluster orchestration.

Weight Poisoning Threat: Exploitation could have enabled silent manipulation of production inference weights and extraction of private model tensors.

Fleet-Wide Remediation: Baseten rotated all tenant keys, dismantled shared build layer caches, and instituted microsegmentation on GPU runtimes.

On September 15, 2026, cybersecurity research firm Wiz published an alarming post-mortem detailing CVE-2026-38192, a vulnerability dubbed 'HarborLeak' that left serverless GPU provider Baseten vulnerable to full multi-tenant infrastructure compromise in under 25 minutes.

Baseten operates high-performance inference infrastructure relied upon by enterprises worldwide to serve open-weights models such as DeepSeek-V3, Llama 3.3, and custom proprietary fine-tunes. To manage deployment packaging, Baseten utilized an automated build engine on top of Harbor, the open-source trusted cloud native registry. When customers pushed Truss packaging bundles, ephemeral build runners compiled container images containing the model runtime and dependencies.

The Wiz researchers discovered that Harbor's intermediate build layer caching mechanism failed to sanitize environment variables and temporary authentication tokens passed during image layer construction. By deploying a specially crafted Truss container that queried internal build mount metadata, researchers retrieved valid Personal Access Tokens (PATs) and internal Kubernetes service tokens with elevated cluster-wide privileges.

Armed with these administrative credentials, an attacker could traverse network namespaces, bypass tenant segregation, and interact directly with the Kubernetes control plane orchestrating thousands of Nvidia H100 and B200 SXM GPUs. Within 25 minutes of execution, the team demonstrated the theoretical capability to modify container images in flight, siphon proprietary model weights directly from NVMe scratch storage, and listen to unencrypted inference traffic.

Weight poisoning in modern AI inference pipelines represents a severe threat vector. If an attacker had subtly perturbed tensor values in a widely served foundation model, they could have introduced targeted logic flaws, forced backdoor activation phrases, or degraded safety guardrails without altering the model's outwardly visible API contract.

Baseten's security engineering team responded decisively upon responsible disclosure. Within 90 minutes of receiving the report, Baseten invalidated all active PAT tokens, disabled cross-tenant build cache reuse, and enforced strict eBPF-based socket filtering to prevent build pods from reaching internal metadata endpoints. Wiz confirmed that forensic analysis showed no evidence of malicious exploitation in the wild.

The Three-Question Framework

What Happened?

Why It Matters

What Could Happen Next

Executive Key Takeaways

Primary Sources & Citations