Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
Docker patched a critical two-year Docker Hub flaw that could let one user push images as another, with no known exploitation.
Docker fixed CVE-2026-105445, a critical Docker Hub flaw open from August 26, 2024, until September 30, 2026, with a CVSS 4.0 score of 9.4. Converting a personal account into an organization transferred its personal access tokens to the designated owner without confirmation, letting that token push, pull, or delete registry images as that user. Registry access did not extend to the web UI, passwords, email, or two-factor settings. Docker reviewed roughly 304,000 pushes made with transferred tokens and said it found no exploitation; affected users were emailed on October 2 and identified tokens were deactivated on October 8.
- CVE-2026-105445 scored CVSS 4.0 9.4 and was open from August 2024 until September 30, 2026.
- Account-to-organization conversion reassigned personal access tokens to the named owner without notice.
- Within token permissions, attackers could push, pull, or delete images under another identity.
- Docker reviewed about 304,000 pushes with transferred tokens and found no exploitation.
- Notified users should review tokens; identified transferred tokens were deactivated on October 8.
- CVEs
- CVE-2026-105445
- Vendors
- Docker
- Products
- Docker Hub
- Organizations
- mptrdev.com
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105445 | Incorrect privilege assignment in Docker Hub token conversion | 9.4 | — |
From the original article
5 min read at thehackernews.com
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that converts a personal account into an organization, Docker said in a security advisory on October 12.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.