Key points
- CVE-2026-105445 allowed token-based impersonation during account conversions.
- Attackers could push, pull, or delete container images in target repositories.
- Docker deployed a fix on September 30, 2026, and deactivated transferred tokens.
Docker disclosed a critical vulnerability, CVE-2026-105445, in its Docker Hub registry that allowed attackers to impersonate other users. According to BleepingComputer, the flaw enabled unauthorized access to container repositories through compromised personal access tokens. The vendor rated the issue as critical due to the potential for software supply chain tampering.
The vulnerability emerged when a user converted a personal Docker Hub account into an organization. During this process, the system reassigned the original account’s personal access token to the new organization owner. As Cyber Security News reported, Docker Hub did not rotate the token secret or obtain consent from the target owner, allowing the attacker to authenticate as the victim.
How the impersonation worked
An attacker could create a new account, generate a personal access token, and then convert that account into an organization. By naming a legitimate user as the organization owner, the attacker triggered the flaw. The registry linked the attacker’s token to the victim’s identity. This allowed the attacker to perform actions within the scope of the token, such as pushing malicious images under a trusted name.
Who is affected
The flaw affected any user whose account was converted into an organization between August 26, 2024, and September 30, 2026. According to the source material, the vulnerability window lasted from August 26, 2024, at 20:33 UTC until the fix was deployed. Users with personal access tokens transferred during this period were exposed. Docker notified affected users and organization owners on October 2, 2026.
Next steps
Docker deployed a production fix on September 30, 2026, less than four hours after receiving the report. The company deactivated all transferred personal access tokens on October 8, 2026, except for those whose owners explicitly requested retention. Docker examined 304,000 pushes made with transferred tokens and analyzed high-risk public images, finding no evidence of exploitation.
Signals worth monitoring
Security teams should review registry logs for unusual image push or delete operations from unexpected sources. Look for authentication events where a token associated with one identity performs actions on another user’s repositories. Monitor for sudden changes in image metadata or layer hashes. Check whether any personal access tokens were transferred during account conversions without explicit owner approval. Verify that all active tokens match their intended scope and owner identity.
What to do and how to stay safe: Docker
- Audit all personal access tokens in your Docker Hub account and revoke any that are no longer needed.
- Review recent image push and pull logs for anomalies, especially from accounts converted to organizations.
- Rotate all existing tokens once the vendor provides an update or if you suspect exposure.
- Monitor for unexpected changes in repository permissions or image contents from trusted sources.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-105445?
It is a critical vulnerability in Docker Hub that allowed attackers to impersonate users by exploiting personal access token reassignment during account conversions.
Did attackers exploit this flaw?
No, Docker found no evidence of exploitation after analyzing hundreds of thousands of image pushes and high-risk public images.
Can this flaw allow full account takeover?
No, the flaw did not provide access to the Docker Hub website or allow changes to passwords, email addresses, or two-factor authentication settings.
