Cybersecurity
Docker Hub flaw let attackers use transferred tokens
Docker said a flaw in Docker Hub let an attacker turn a personal account into an organisation, reassign a token and use it to reach another user’s repositories and images.
- Docker disclosed CVE-2026-105445 in Docker Hub.
- The flaw appeared on 26 August 2024, when account conversion began reassigning personal access tokens without revoking the secret or asking for consent.
- A transferred token could let an attacker act as the target user at registry level and reach repositories the target could access.
- Docker received a report on 30 September 2026, fixed the issue in production within four hours and notified affected users on 2 October.
- Docker said it found no evidence of exploitation after examining 304,000 pushes and high-risk public images.
Docker disclosed CVE-2026-105445 in Docker Hub, saying the issue let a personal access token tied to one account be used under another user's identity after an account conversion. It said the flaw affected the registry rather than Docker Hub web access.
According to Docker, an attacker could create an account and token, convert the account into an organisation, and then name a target user as owner. Docker said the token was reassigned without changing its secret or seeking the owner's agreement.
Docker said the effect depended on the token's scope and the target user's permissions. In some cases, it said, the token could be used to pull, push or delete images in the target's repositories and in organisations the target could access.
Docker said the vulnerability began on 26 August 2024 and that it received a report on 30 September 2026. It said it confirmed the issue, fixed it in production in under four hours, notified affected users on 2 October and deactivated transferred tokens on 8 October, except where owners asked to keep them.
Docker said it found no evidence that the flaw had been used after reviewing 304,000 pushes made with transferred tokens and analysing high-risk public images. It also said users who did not receive a notice should assume they were not affected and did not need to act.
Named in this story
Companies
- Docker
- disclosed the flaw and described the fix
Products and systems
- Docker Hub
- the registry where the vulnerability existed
- CVE-2026-105445
- the identifier for the disclosed vulnerability
How the source tells it
The article read like a straightforward security disclosure, with restrained urgency from the critical rating and a brief note of reassurance that Docker found no signs of abuse.
- urgency the critical severity rating and the described image-access impact
- reassurance the statement that no evidence of exploitation was found and users who received no notice were told they were not affected