Postmortem: How a Docker 26.0 Image Vulnerability Led to a Production Breach Published: October 12, 2024 | Incident ID: INC-2024-0927 | Severity: Critical Executive Summary On September 27, 2024, our security team detected unauthorized access to our production Kubernetes cluster. The root cause was traced to a hardcoded CI/CD token exposed in a container image built with Docker Engine 26.0.0, which contained a known vulnerability (CVE-2024-3092) in its multi-stage build process. The token was extracted by an external attacker, who used it to deploy cryptomining workloads and exfiltrate 1.2TB of customer metadata. This postmortem details the timeline, root causes, remediation, and lessons learned from the incident. Timeline of Events September 18, 2024, 09:00 UTC: Engineering team upgrades all CI runner hosts to Docker Engine 26.0.0 to adopt new build cache features.…