Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
Read original article ↗AI Summary
Docker fixed a critical vulnerability, tracked as CVE-2026-105445, that existed in Docker Hub from August 26, 2024, until September 30, 2026. The flaw allowed a user to convert a personal account into an organization and transfer ownership of personal access tokens (PATs) to another user without consent or notification, enabling unauthorized access to repositories. This could allow an attacker to push, pull, or delete images under another user's identity, including publishing malicious images under legitimate names. Docker found no evidence of exploitation despite reviewing over 304,000 pushes, and the vulnerability was reported by researchers Peter Molnar and Krisztian Hozak of mptrdev.com, who named it GhostPat.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.