Docker Hub flaw let attackers impersonate users, tamper with images

Docker Hub disclosed a critical vulnerability, CVE-2026-105445, that allowed attackers to impersonate users and tamper with container images by exploiting a flaw in the personal access token (PAT) reassignment process during account-to-organization conversion. Attackers could create a personal account, generate a PAT, convert the account to an organization, and assign a target user as the owner, causing the PAT to be reassigned to that user without consent or token rotation. This enabled unauthorized access to the target's repositories, posing a significant software supply chain risk. Docker patched the flaw within four hours of receiving the report on September 30, 2026, and found no evidence of exploitation after analyzing over 300,000 image pushes.

AI-extracted · verify before operational use