FHN 
Docker has fixed a critical Docker Hub security flaw that could allow attackers to impersonate users and upload container images under trusted names.
Tracked as CVE-2026-105445, the vulnerability involved personal access tokens that were transferred to another account during organization conversions. Docker fixed the issue on September 30, 2026, and reported no evidence of exploitation.
The flaw created a potential software supply chain risk because developers and businesses could unknowingly rely on altered container images.
How the Docker Hub Flaw Worked
Docker Hub allows users to convert personal accounts into organizations while keeping their existing repository names. However, a problem with this process caused personal access tokens (PATs) to be transferred to the selected organization owner without changing the token secret or notifying the owner.
An attacker could create an account, generate a token, and convert the account into an organization while selecting a victim as its owner. The token could then authenticate as the victim, potentially allowing unauthorized access to repositories.
Depending on the token’s permissions, an attacker could:
- Upload or modify container images.
- Access images in personal repositories and connected organizations.
- Delete images within the token’s permitted scope.
The flaw did not allow full account takeover or access to the victim’s password, email settings, or two-factor authentication controls.
Docker’s Investigation and Fix
The vulnerability affected account conversions from August 26, 2024, until Docker deployed its fix on September 30, 2026.
Docker reviewed account conversions, token records, registry activity, and approximately 304,000 image pushes associated with transferred tokens. The company reported no evidence of malicious exploitation or suspicious image modifications linked to the flaw.
Docker subsequently notified affected users and organization owners. On October 8, it deactivated transferred tokens, except those owners requested to retain.
Recommended Security Measures
Organizations using Docker Hub should review their access tokens and container publishing processes.
- Review personal access tokens: Revoke unfamiliar or unnecessary tokens and check their permissions.
- Secure automation: Consider organization access tokens for organizational workflows.
- Verify container images: Review image provenance and scan images before deployment.
- Monitor repository activity: Investigate unexpected image pushes, modifications, or deletions.
Docker has also stated that it is improving the account conversion process with owner consent, notifications, and records of token ownership changes.
This incident highlights the importance of protecting credentials and verifying the integrity of software supply chains. Even when an account appears legitimate, weaknesses in identity and token management can create opportunities for unauthorized access.
About the Author
