Docker has disclosed a critical vulnerability in Docker Hub, identified as CVE-2026-105445, which could have allowed attackers to access other users' container repositories using a personal access token (PAT). The flaw stemmed from how Docker Hub reassigned PATs during account-to-organization conversions without proper user consent or token revalidation. This allowed an attacker to potentially impersonate a legitimate user and access their repositories, posing a significant software supply chain risk, as first reported by Bleeping Computer.
The vulnerability allowed an attacker to create a Docker Hub account, generate a PAT, and then convert the account into an organization, naming a target user as the owner. The flaw occurred because Docker Hub reassigned the PAT to the new organization owner without changing its secret or obtaining the target's consent. This enabled the attacker to use the token to authenticate as the target user, with permissions dependent on the token's scope and the target's access. Attackers could potentially pull, push, or delete container images from the target's repositories and any organizations the target had access to. Docker rated the vulnerability as critical due to the software supply chain risk it presented. The company stated that the vulnerability did not grant web access, allow password changes, or affect two-factor authentication settings. Docker fixed the issue within four hours of being reported on September 30, 2026, and found no evidence of exploitation. Affected users were notified, and transferred PATs were deactivated.
Source: Bleeping Computer
