GCVE-110-OSM-2026-9289

This Docker Hub image was confirmed malicious by static analysis. It carries out actions that fit malware rather than the stated purpose of the image. Knorr inspected the image configuration and unpacked its layers. The image was read but never executed. The detection rule, the attacker infrastructure, and the exact location of the malicious code appear in the payload details so the finding can be verified independently. Location of the malicious code: layer file app/app/cleanup_templates.py. Detection rule preload-rootkit matched on this line: "app/app/cleanup_templates.py: """ Cleanup function to remove duplicate and malformed schedule templates. Can be imported and called from startup or run as a standalone script. """ import asy".