Science & Tech · Cybersecurity · 2 hrs ago
Docker fixes critical flaw that let attackers use users’ access tokens
A flaw in Docker Hub let attackers impersonate users by using their personal access tokens, which authenticate tools and workflows.
Docker Hub is a service for storing and sharing container images, packages that applications need to run.
The flaw affected tokens reassigned when an account became an organization, allowing attackers to pull, publish or delete images within the token’s permissions.
Docker rated the issue critical because attackers could publish altered images under legitimate names, creating a software supply chain risk.
Docker fixed the flaw within four hours of confirming it and says it found no evidence of exploitation.
It notified affected users and deactivated transferred tokens; users who received no notification do not need to take action, Docker says.
Docker fixed a critical Docker Hub flaw that let attackers use personal access tokens to act as other users.
The flaw could allow attackers to pull, push or delete container images in affected repositories and organizations.
Docker said the risk included publishing images under a legitimate name, creating a potential software supply chain threat.
The vulnerability was reported on September 30, 2026, and Docker deployed a fix less than four hours after confirming it.
Docker said it found no evidence that the flaw had been exploited.
- Who
- Attackers could use the flaw to access another Docker Hub user’s repositories; Docker fixed it.
- What
- A vulnerability allowed a personal access token to be reassigned without changing its secret or getting the owner’s consent.
- When
- The flaw was introduced on August 26, 2024. Docker received a report on September 30, 2026, and deployed a fix less than four hours after confirming it.
- Where
- Docker Hub, Docker’s online registry for container images.
- Why
- The flaw arose when Docker Hub reassigned a personal access token to a designated organization owner without revoking or rotating the secret or seeking consent.
This story does not have two clearly opposing sides.
The flaw was introduced when Docker Hub began reassigning personal access tokens during account-to-organization conversions.
Docker received a vulnerability report, confirmed the issue and deployed a production fix less than four hours later.
Docker notified affected users and organization owners.
Docker deactivated transferred personal access tokens, except those whose owners explicitly requested to retain them.
- Vulnerability
- CVE-2026-105445
- Potential impact
- Attackers could pull, push or delete images in accessible repositories and organizations
- Fix response
- Deployed to production less than four hours after confirmation
- Exploitation review
- Docker examined 304,000 pushes made with transferred tokens and said it found no evidence of exploitation
- Token deactivation
- October 8, 2026, with exceptions for tokens owners explicitly asked to retain
What people are saying
Within the scope of the token, a re-assigned PAT acted as the target user at the registry level, meaning an attacker could potentially pull, push, and/or delete images in the target’s repositories and in organizations where the target had access
Because that includes publishing images under a legitimate name, we treated this as a software supply chain risk and rated it critical.
Sources
Related news
Cyberattack disrupts IT systems at three TFG London fashion brands
Canadian cybersecurity executive arrested in ShinyHunters investigation
Cyberattack disrupts refrigeration at hundreds of French supermarkets
Norway fines Microsoft-owned Xandr $9.6 million over Grindr data sharing
GitLab fixes maximum-severity flaw that could let attackers run server code
Ledger links CryptoBilis wallet implants to confirmed crypto thefts
DDoS attack disrupts Canonical websites for more than four hours
GitHub adds 48-hour limit after npm publishing flaw exposed 1,500 packages
Survey finds human error is the leading cybersecurity concern
Ahold Delhaize takes systems offline after cybersecurity incident
Cyberattacks target refrigeration systems at more French supermarkets
