Skip to content
Critical Docker Hub Vulnerability Allows User Impersonation

Critical Docker Hub Vulnerability Allows User Impersonation

First seen 13 Oct 2026, 16:34 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 17:33 UTC
  • •CVE-2026-105445 allows user impersonation via Docker Hub's PAT.
  • •Docker fixed the vulnerability within hours of confirmation on September 30, 2026.
  • •No evidence of exploitation was found after reviewing token activity.

Docker disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that allowed attackers to impersonate users and tamper with container images. The flaw enabled attackers to access another user's container repositories using a personal access token (PAT) without consent. Introduced on August 26, 2024, the vulnerability allowed attackers to convert a personal account into an organization and name a target user as its owner, thus gaining unauthorized access. Docker confirmed the issue on September 30, 2026, and deployed a fix within hours. Affected users were notified on October 2, and transferred PATs were deactivated on October 8. Docker found no evidence of exploitation after reviewing 304,000 pushes made with transferred tokens. The company has since changed its process to require user consent before transferring PATs during account conversions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-08-26
Vulnerability introduced
Docker Hub began reassigning PATs during account conversions without user consent.
Bleepingcomputer
2026-09-30
Vulnerability reported
Security researchers reported the vulnerability through Docker's Vulnerability Disclosure Program.
Docker.com
2026-10-02
Affected users notified
Docker sent notifications to users whose accounts were potentially impacted by the vulnerability.
Bleepingcomputer
2026-10-08
PATs deactivated
Docker deactivated transferred PATs, except for those users who requested to retain them.
Bleepingcomputer

More articles in this cluster (2)

Following this threat?

Track CVE-2026-105445 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

How can I tell if I'm affected?
If you received an email from Docker on October 2, you may be affected; otherwise, you are not.
What actions should I take now?
If you were notified, follow Docker's instructions; otherwise, no action is needed.
What changes has Docker made to prevent this issue?
Docker now requires user consent before transferring PATs during account conversions.