Docker Hub vulnerability allowed attackers to hijack user tokens and alter container images

Docker has patched a critical vulnerability tracked as CVE-2026-105445 that permitted attackers to commandeer another user's container repositories by obtaining a personal access token (PAT). Docker Hub functions as a central registry where developers store, distribute, and retrieve container images—standardized packages containing all dependencies required for applications to execute in isolated environments.

Within Docker Hub's ecosystem, a PAT operates as an authentication credential enabling tools and automation workflows to perform operations on container images, including retrieval, upload, and removal.

How the flaw worked

According to Docker's security advisory, the vulnerability stemmed from a flawed account conversion mechanism. An attacker could establish a new account with its own PAT, then initiate a conversion of that account into an organization while designating a target user as the organization's owner.

The core issue: Docker Hub reassigned the attacker's PAT to the newly designated organization owner without modifying the token's underlying secret or requesting approval from the target user. This design flaw meant the attacker retained the ability to use the token for authentication, but now with the target's identity and permissions.

Depending on the token's configured permissions and the target user's access level, an attacker could retrieve, upload, or erase container images stored in the target's repositories and any organizations where the target held membership.

Within the scope of the token, a re-assigned PAT acted as the target user at the registry level, meaning an attacker could potentially pull, push, and/or delete images in the target's repositories and in organizations where the target had access. Because that includes publishing images under a legitimate name, we treated this as a software supply chain risk and rated it critical.

Docker

Docker clarified that despite the severity rating, the vulnerability did not grant attackers access to Docker Hub's web interface or enable them to alter passwords, email accounts, or multi-factor authentication settings—actions that might have permanently locked legitimate users out of their accounts.

Timeline and remediation

The vulnerability was introduced on August 26, 2024, when Docker began automatically reassigning personal account PATs to new organization owners during account conversion, without revoking the original token or requesting confirmation from the designated owner.

On September 30, 2026, Docker received a vulnerability disclosure describing the issue. The company confirmed the problem and deployed a corrective patch to production within four hours.

Docker conducted a forensic review examining 304,000 image uploads performed using transferred tokens and scrutinized high-risk public images for signs of malicious activity. The company reported finding no evidence of actual exploitation.

Affected users and organization administrators received notification on October 2. Transferred PATs were deactivated on October 8, with the exception of tokens whose owners explicitly chose to preserve them. Docker stated that users who did not receive a notification should consider themselves unaffected and require no remedial steps.

Changes implemented

Going forward, Docker Hub no longer transfers PATs when converting a personal account into an organization. The platform now mandates explicit user consent before designating an individual as an organization owner.