NewsEditorialSource: Docker
Docker disclosed Hub token flaw that allowed registry impersonation
Docker disclosed a critical Docker Hub vulnerability on October 12, 2026, that allowed holders of reassigned personal access tokens to impersonate other users for registry operations. [1] The flaw, CVE-2026-105445, reassigned tokens during account-to-organization conversions without changing their secrets or obtaining consent. [1] Token holders could pull, push or delete images within each token’s scope. [1] Docker said exposure ran from August 26, 2024, to September 30, 2026, when it deployed a fix within four hours of receiving the report. [1] The company reported no evidence of exploitation after examining approximately 304,000 pushes using transferred tokens and inspecting higher-risk public images. [1]
Why it matters
Affected teams’ images could have been accessed or modified without authorization, but the flaw did not allow web-interface access or full account takeover. [1] Docker advises reviewing personal access tokens, revoking unfamiliar or unnecessary credentials, and using organization access tokens for organization automation. [1] Docker says conversion no longer transfers personal access tokens; it treated every transferred token as potentially affected because unused tokens leave no registry-use trace. [1] The Hacker News reported that the advisory does not disclose affected-user or token counts, or investigation findings specifically addressing pulls and deletions, including private-image downloads. [3]
Attribution
Sources
- 1DockerDocker Hub Security Advisory: CVE-2026-105445Source published (UTC)
- 2BleepingComputerDocker Hub flaw let attackers impersonate users, tamper with imagesSource published (UTC)
- 3The Hacker NewsDocker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as AnotherSource published (UTC)
Read the original source for full details and context.