Docker Hub Vulnerability Enabled Account Impersonation Through Token Reassignment
Docker has disclosed a critical security vulnerability, identified as CVE-2026-105445, affecting Docker Hub that allowed attackers to impersonate legitimate users and manipulate their container images. The flaw resided in the platform’s account-to-organization conversion process, where a personal access token (PAT) originally assigned to an individual user could be reassigned to a newly created organization without the token being rotated or the user’s consent obtained.
According to Docker’s official security bulletin, an attacker could exploit this by creating a new account, generating a PAT, and then converting that account into an organization while designating a target user as the owner. During this conversion, Docker Hub retained the original PAT’s secret value and associated it with the organization owner — effectively granting the attacker the ability to authenticate as the target user.
Impact of the CVE-2026-105445 Flaw on Container Image Integrity
Because the reassigned PAT maintained the same scope and permissions as the original user’s token, attackers could use it to pull, push, or delete container images within the victim’s repositories and any organizations where the target user had access. This included the ability to publish malicious images under a trusted namespace, which Docker classified as a software supply chain risk.
"Within the scope of the token, a re-assigned PAT acted as the target user at the registry level, meaning an attacker could potentially pull, push, and/or delete images in the target’s repositories and in organizations where the target had access,"
Docker stated in its advisory.
The company emphasized that because attackers could publish images under legitimate user names, the flaw posed a significant risk to the integrity of the software supply chain, warranting a critical severity rating.
Timeline and Response to the Docker Hub Security Incident
The vulnerability was introduced on August 26, 2024, when Docker Hub began reassigning PATs during account-to-organization conversion without revoking the token or requiring confirmation from the newly designated owner. This process continued for over two years until a vulnerability report was submitted to Docker on September 30, 2026.
Upon receiving the report, Docker confirmed the issue and deployed a fix to production in less than four hours. The company subsequently conducted a thorough investigation, analyzing 304,000 image pushes made using transferred tokens and reviewing high-risk public images for signs of exploitation. No evidence of malicious activity was found.
To mitigate risk, Docker notified affected users and organization owners on October 2, 2026. Transferred PATs were deactivated on October 8, 2026, except in cases where owners explicitly requested to retain them. Users who did not receive a notification were advised that they were likely not impacted and did not need to take any action.
Changes Implemented to Prevent Future Exploitation
Following the incident, Docker modified its account conversion process to no longer transfer PATs automatically during the conversion of a personal account to an organization. The platform now requires explicit user consent before naming an individual as an organization owner, ensuring that tokens are not reassigned without authorization.
This update eliminates the conditions that allowed CVE-2026-105445 to be exploited, closing the loophole that could have enabled unauthorized access to private repositories and the potential distribution of tampered container images under trusted identities.
Source: BleepingComputer