Abstract
Docker Hub is the registry underneath most container deployments, and a flaw in a widely
reused base image is inherited by every image built on it. Prior ecosystem-scale
measurements each rely on a single detector, leaving the tool-dependence of their counts
unquantified, while the studies that do compare scanners use samples of tens to hundreds of
images. We present ChimangoScan, a pipeline that crawls the Docker Hub namespace
(12,716,568 repositories, 663.8 billion cumulative pulls), reconstructs the image layer
graph (54.4 million IS_BASE_OF edges), ranks images by an exposure score that
folds an image's own pull count and those of its entire downstream subtree into one scalar,
and scans the 52,895 highest-exposure repositories (84.7% of all recorded pulls) with six
independent scanners, yielding 170.4 million findings. Vulnerabilities are near-universal:
96.3% of images carry a known package vulnerability, 93.4% a critical one, and 98.0% at
least one CIS Docker Benchmark misconfiguration. The posture a single tool reports is
largely an artifact of that tool: of 80.7 million distinct (vulnerability, package) groups,
66.8% are flagged by only one of the three vulnerability scanners and just 2.7% by all
three, and the best single scanner recovers 66.9%. TruffleHog flags a secret in 76.9% of
images, yet hand-labeling 1,100 random detections finds 99.7% are non-credentials. A single
zlib CVE reaches images carrying 47.3% of total corpus exposure and propagates to 1.13
million distinct downstream images, but exposure does not predict how vulnerable an image
is. We release the pipeline and the 283 GB dataset.
The corpus
A crawl of the whole public namespace, a layer graph built on top of it, and a scan campaign aimed at the images the ecosystem actually depends on.
- 12,716,568 public repositories enumerated, from 2,051,801 prefix queries
- 663,779,362,551 cumulative historical pulls recorded across those repositories
- 7,416,671 image digests resolved from 5,601,045 repositories and 6,399,608 tags
-
54,382,383
IS_BASE_OFlayer edges over 84.7 M layer nodes, in Neo4j - 52,895 highest-exposure repositories scanned — 84.7% of all recorded pulls
- 170,373,044 findings from six independent scanners
What the scan found
Prevalence at the top of the ranking is near-universal. Shares are of the 52,895 scanned repositories.
96.3%
carry at least one known package vulnerability
50,957 images. Only 3.7% are clean.
93.4%
ship a critical-severity vulnerability
49,392 images; 95.5% ship a high-severity one.
98.0%
fail at least one CIS Docker Benchmark check
51,853 images. 94.1% have no HEALTHCHECK instruction and 79.1% run without a dedicated user.
885
merged vulnerability findings in the median image
Mean 2,679; 99th percentile 20,109; maximum 113,166.
141,683,960 package-vulnerability findings, by severity
Critical and high together come to 43.1 million severe findings. Counts are merged across scanners and deliberately not deduplicated — that is what makes the disagreement below measurable.
The scanner is part of the measurement
Every image was scanned by all three vulnerability scanners. Grouping the findings within each image by (vulnerability, package) gives 80.7 million distinct groups.
66.8%
of distinct groups are reported by only one of the three scanners
2.7%
are reported by all three
66.9%
is all the best single scanner recovers — a one-tool measurement misses about one distinct vulnerability in three
Findings emitted, three vulnerability scanners
A 1.55× spread in volume between the highest and lowest, over identical inputs. The other three scanners measure different things: Syft inventoried 23,151,449 software components, TruffleHog reported 4,921,296 secret hits, Dockle 235,029 misconfigurations.
Share of images scanned without error
Trivy failed on 10,614 invocations, four in five of them timing out on the tool's own local cache lock rather than on anything about the image. A measurement relying on Trivy alone would silently miss roughly one image in five.
Secrets: a detector rate is not a secret rate
- 76.9%of images have at least one TruffleHog hit — 40,667 images, 4.9 M findings
- 1,100detections drawn at random and classified by hand, every one of them
- 3were plausible live credentials: a service-account key, an SSH host key, and an access token in an application log
- 99.7%of the sample were non-credentials — 1,097 of 1,100, Wilson 95% CI 99.2 to 99.9%
About 60% of the hits are package checksums and operating-system metadata; the rest are
test fixtures, dependency caches, documentation examples, placeholders, and binary or
locale artifacts. Every PrivateKey detection but the service-account key
landed in a crypto-library self-test, an SSH or TLS fixture, or a shared object.
The count per image is heavy-tailed as well: the median image carries 13 detector hits, the 99th percentile 1,230, and the worst image 19,856.
The practical consequence in the paper: raw secret detections should not gate a deployment. A validation step has to come first.
Exposure says where, not how bad
Exposure folds an image's own pull count and those of every image inheriting its layers into one score. It ranks reach. It does not predict vulnerability.
ρ = −0.01
Spearman correlation, pull count against distinct vulnerability count
−0.02 for exposure against vulnerability count, −0.04 against critical count. All negligible.
369
median vulnerabilities in the highest-exposure decile
No clear trend across deciles; critical prevalence stays near 93% throughout.
~83 B
pulls a critical flaw in alpine would reach
11.8 B of its own pulls, plus roughly 71 B from images built on its layers.
The images the ecosystem most depends on are not better maintained — but a flaw in one of them travels much further. That gap between affected-image count and exposure share is what the score is for: it gives registry operators and platform teams a remediation order.
How ChimangoScan works
Three stages. Stages I and II in Go, Stage III in Python.
-
Stage I
Repository discovery
The Docker Hub Search API caps any query at 10,000 results, so the crawler walks a prefix trie of repository names: 38 single-character seeds, and any prefix that returns the ceiling is expanded into its 38 children, shortest first. Distributed, resumable, and run over several months in 2026.
2,051,801 prefix queries · 12,716,568 repositories · median 62 pulls, and 113 repositories draw 60.6% of all pulls
-
Stage II
Image resolution and the layer graph
Each repository is claimed exclusively from a shared pool, resolved into tags and manifests, pulled, and decomposed into its ordered filesystem layers. Layer nodes carry an ancestry hash, so identical content with a different history stays distinct and each layer has at most one parent — the graph is a forest of out-trees.
5,601,045 repositories resolved (44.05% of the crawl) · 6,399,608 tags · 7,416,671 digests · 54,382,383 edges
-
Stage III
The six-scanner scan
Workers take the exposure-ordered queue, pull each image pinned by digest, and run six static scanners across four dimensions: software inventory (Syft); package vulnerabilities from three separate databases (Trivy, Grype, OSV-Scanner); misconfiguration against the CIS Docker Benchmark (Dockle); and hardcoded secrets (TruffleHog). Per-scanner adapters normalise output to one six-level severity scale.
13 commodity x86-64 workers ·
linux/amd64only · median 117 s per image · 52,624 distinct CVEs detected
Code and data
The pipeline and the full 283 GB dataset are released: 192 GB of per-image scan reports, 65.9 GB of Neo4j layer graph, and 24.9 GB of MongoDB crawl.
What this does not measure
- The corpus is the top of the exposure ranking, not a random sample. It describes the most consequential images, not the average one — and it is not an upper bound, because exposure does not predict vulnerability.
- The 76.9% secret figure counts raw detector hits, 99.7% of them non-credentials by hand-labeling.
- Reported vulnerabilities are static scanner findings, not confirmed exploitable.
- Per-image counts are merged across scanners, not deduplicated, which is why medians are reported. The unit is one
latestimage per repository; deduplicating to 51,751 distinct digests leaves the results unchanged. - Only
linux/amd64was scanned, and Stage II resolved 44% of the crawl, so the propagation counts are lower bounds.
Cite this work
@misc{kapelinski2026highestexposure,
title = {Vulnerabilities, Secrets and Misconfiguration in the
Highest-Exposure Docker Hub Images},
author = {Kapelinski, Cristhian and Machado, Beatriz and Kreutz, Diego},
year = {2026},
eprint = {2608.02669},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
url = {https://arxiv.org/abs/2608.02669}
}