Docker Hub flaw let attackers impersonate users and tamper with images

Docker patched a critical token issue that could have let attackers act as another user in Docker Hub and change images tied to that account.

Docker has patched a critical Docker Hub issue, CVE-2026-105445, that could let an attacker take over another user’s registry identity through a personal access token and then tamper with images tied to that account. The bug affected the account-to-organization conversion flow: a token could be reassigned to the new organization owner without rotating the secret or getting consent, which in some cases let the attacker pull, push, or delete images in repositories the target could reach. Docker said it treated the problem as a supply-chain risk, fixed it within hours of the report on September 30, 2026, and found no evidence of real-world abuse after reviewing 304,000 pushes made with transferred tokens. The company notified affected users on October 2 and deactivated transferred tokens on October 8, while also changing the product so PATs are no longer transferred during conversion and owner consent is required.