Full Report
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]
Analysis Summary
# Vulnerability: Docker Hub Account Takeover via PAT Reassignment
## CVE Details
- **CVE ID:** CVE-2026-105445
- **CVSS Score:** 9.1 (Critical) - *Score estimated based on vendor "Critical" rating and impact description.*
- **CWE:** CWE-287 (Improper Authentication) / CWE-284 (Improper Access Control)
## Affected Systems
- **Products:** Docker Hub (Cloud Registry Platform)
- **Versions:** Vulnerability introduced August 26, 2024; Fixed September 30, 2026.
- **Configurations:** Accounts where a Personal Access Token (PAT) was active during a "Personal to Organization" account conversion process.
## Vulnerability Description
The flaw stems from a logic error in how Docker Hub handled Personal Access Tokens (PATs) during the conversion of a personal account into an organization. When an attacker created an account and converted it into an organization, they could designate a target user as the new owner.
Docker Hub would then reassign the attacker's existing PAT to that target user without rotating the token secret or requiring consent from the target. This resulted in the attacker possessing a valid, active token that authenticated them as the target user at the registry level.
## Exploitation
- **Status:** Not exploited (No evidence of exploitation found in the wild per Docker analysis).
- **Complexity:** Low
- **Attack Vector:** Network
- **PoC Availability:** Not publicly available (Reported via private disclosure).
## Impact
- **Confidentiality:** High (Access to private container images).
- **Integrity:** High (Ability to push malicious/tampered images under legitimate user names, posing a supply chain risk).
- **Availability:** Medium (Ability to delete images in repositories).
*Note: The flaw did **not** provide web UI access or the ability to change account security settings (2FA, passwords).*
## Remediation
### Patches
- **Platform Fix:** Docker deployed a server-side fix to production on September 30, 2026.
- **Action Taken:** Docker deactivated all affected transferred PATs on October 8, 2026, except for those where owners explicitly opted to keep them.
### Workarounds
- **User Action:** No manual software update is required as this was a platform-side vulnerability. Users who were not notified by Docker on October 2, 2026, are considered not impacted.
## Detection
- **Indicators of Compromise:** Review Docker Hub audit logs for unauthorized `push`, `pull`, or `delete` actions occurring between August 2024 and September 2026.
- **Detection Methods:** Docker analyzed 304,000 pushes and high-risk public images; no unauthorized activity was identified. Users can review their active PATs in Docker Hub settings to ensure no unrecognized tokens exist.
## References
- **Vendor Advisory:** hxxp[://]www[.]docker[.]com/blog/docker-hub-security-advisory-cve-2026-105445/
- **News Source:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/