Skip to content
Docker Hub Fixes Critical Vulnerability Allowing User Impersonation

Docker Hub Fixes Critical Vulnerability Allowing User Impersonation

First seen 13 Oct 2026, 16:34 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 08:29 UTC
  • •CVE-2026-105445 allows user impersonation via PATs in Docker Hub.
  • •The vulnerability was active for over two years before being fixed on September 30, 2026.
  • •Docker found no evidence of exploitation after reviewing token activity.

Docker disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that allowed attackers to impersonate other users by misusing personal access tokens (PATs). The flaw, introduced on August 26, 2024, enabled an attacker to create an account, convert it into an organization, and reassign a PAT to a target user without their consent. This could allow the attacker to pull, push, or delete images in the target's repositories. Docker confirmed no evidence of exploitation after reviewing 304,000 pushes made with transferred tokens. The vulnerability was fixed on September 30, 2026, and affected users were notified on October 2, 2026. Docker has since changed its process to require user consent for such account conversions. The flaw has a CVSS score of 9.4, indicating its critical nature.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2024-08-26
Vulnerability introduced
Docker Hub began reassigning personal access tokens during account conversions without user consent.
Bleepingcomputer
2026-09-30
Vulnerability reported and fixed
Docker confirmed the vulnerability and deployed a fix within four hours of receiving the report.
Docker.com
2026-10-02
Affected users notified
Docker sent notifications to users and organization owners whose accounts could have been impacted by the vulnerability.
Bleepingcomputer
2026-10-13
CVE-2026-105445 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (6)

Following this threat?

Track CVE-2026-105445 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 4

Common questions

How was the vulnerability exploited?
Attackers could impersonate users by reassigning personal access tokens during account conversions without consent.
What steps has Docker taken after the vulnerability?
Docker now requires user consent for account conversions and has deactivated transferred tokens.
Should I be concerned about my account?
If you did not receive a notification from Docker, you were not impacted by this vulnerability.