GoKawiilDocker Hub bug (CVE-2026-105445) let attackers hijack access tokens of other users
Docker disclosed a critical flaw in Docker Hub where converting a personal account into an organization could reassign that account's personal access token to a named owner without rotating the token or requiring the target's consent. An attacker could exploit this to authenticate as the target user, gaining the ability to pull, push, or delete images in their repositories, depending on the token's scope and permissions. The bug has existed since August 26, 2024, though it did not grant web access or allow changes to passwords, email, or two-factor settings.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the flaw could let attackers publish images under a legitimate user's name, Docker classified it as a software supply chain risk, since malicious or tampered container images could be distributed to unsuspecting downstream users who trust the publisher. The long window since introduction in 2024 suggests the exposure may have been exploitable for well over a year before disclosure, raising questions about how many repositories were affected. Organizations relying on Docker Hub images for CI/CD pipelines may need to review token usage and image provenance as a precaution.
- CVE-2026-105445 allowed attackers to impersonate users via reassigned personal access tokens on Docker Hub.
- The flaw stemmed from account-to-organization conversion reassigning tokens without rotation or consent.
- Docker rated it critical due to supply chain risk, though it did not expose account web access or credentials.
Source: bleepingcomputer.com, 2026-10-13
Published there as: “Docker Hub flaw let attackers impersonate users, tamper with images”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.