● Covered by 2 sources · 2 reportsMedium impact2 neutral
Docker Hub Critical Flaw Allowed User Impersonation and Image Tampering
Key points
- Critical vulnerability CVE-2026-105445 found in Docker Hub.
- Allowed attackers to impersonate users via reassigned Personal Access Tokens (PATs).
- Enabled unauthorized manipulation (pull, push, delete) of container images.
- Flaw existed for over two years, from August 26, 2024, until fixed on September 30.
- Docker found no evidence of exploitation; fix applied directly to Docker Hub.
Critical Vulnerability in Docker Hub
Docker has addressed a critical vulnerability, identified as CVE-2026-105445, within its Docker Hub platform. This flaw allowed unauthorized access to user container repositories by enabling attackers to impersonate other users through their personal access tokens (PATs). The vulnerability was rated with a CVSS 4.0 score of 9.4, indicating its severity.
Mechanism of the Flaw
The vulnerability originated from a specific process within Docker Hub: the conversion of a personal account into an organization. During this conversion, if a target user was designated as the organization's owner, their existing PATs were reassigned to the new organization without altering the token's secret or requiring the target's consent. This allowed an attacker, who initiated the conversion, to use the reassigned PAT to authenticate as the target user.
Depending on the scope of the PAT and the target's permissions, an attacker could then perform actions such as pulling, pushing, or deleting container images within the target's repositories and any accessible organizations. This posed a significant software supply chain risk, as malicious images could potentially be published under legitimate user names.
Impact and Scope
Docker Hub serves as an online registry for storing, sharing, and downloading container images, which are essential templates for running applications in isolated environments. PATs are crucial for authenticating tools and workflows within this ecosystem. While the flaw granted access to the registry for image manipulation, it did not extend to the Docker Hub web interface, nor could it be used to change passwords, email addresses, or two-factor authentication settings, or to fully take over an account.
Discovery and Resolution
The vulnerability was present in Docker Hub for over two years, specifically from August 26, 2024, until it was fixed on September 30. Docker disclosed the flaw in a security bulletin on October 12. The fix was implemented directly on Docker Hub, meaning no user action or update installation is required. Docker has stated that it found no evidence of the flaw being exploited during its active period.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Docker fixed a critical two-year-old flaw in Docker Hub that allowed one user to push, pull, or delete container images as another user. The vulnerability, tracked as CVE-2026-105445, stemmed from how personal access tokens were handled during account conversion to an organization. Docker found no evidence of exploitation, but the flaw could have enabled malicious image publishing under legitimate names.
Docker disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that allowed attackers to access user container repositories using a personal access token (PAT). The flaw enabled attackers to impersonate target users and potentially manipulate container images, posing a software supply chain risk.