Docker Hub fixed critical flaw that let PATs impersonate users

Feeds.4Sysops •IT News • October 13, 2026

Docker fixed a Docker Hub vulnerability that let attackers turn their own personal access tokens (PATs) into credentials for another user, potentially allowing image changes under trusted names. The flaw, tracked as CVE-2026-105445, was introduced in August 2024; Docker says it found no evidence of exploitation after reviewing transferred-token activity. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Docker Hub Fixes Critical Vulnerability Allowing User Impersonation Docker disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that allowed attackers to impersonate other users by misusing personal access tokens (PATs). The flaw, introduced on August 26, 2024, enabled an attacker to create an account, convert it into an organization, and reassign a PAT to a target user without their consent. This could allow the attacker to pull, push, or delete images in the target's repositories. Docker confirmed no evidence of exploitation after reviewing 304,000 pushes made with transferred tokens. The vulnerability was fixed on September 30, 2026, and affected users were notified on October 2, 2026. Docker has since changed its process to require user consent for such account conversions. The flaw has a CVSS score of 9.4, indicating its critical nature. 4 sources 71

Extracted Entities

Docker Hub fixed critical flaw that let PATs impersonate users

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)