A significant vulnerability in Docker Hub, the platform for publishing and downloading container images, has been rectified after remaining undetected for over two years. This flaw allowed users to manipulate images on behalf of other users without their consent. Docker announced the resolution of this issue on September 30, confirming that there was no evidence of exploitation during the vulnerability period.
Understanding the Docker Hub Vulnerability
The flaw stemmed from the process of converting a personal account into an organization account. According to Docker’s October 12 security advisory, this conversion mistakenly transferred personal access tokens (PATs) to the new organization’s owner. PATs serve as password substitutes within the registry, granting substantial control over account actions. Notably, this flaw did not compromise the Docker Hub web interface, meaning sensitive account settings like passwords and email addresses remained secure.
Tracked as CVE-2026-105445, Docker rated this vulnerability as critical, assigning it a CVSS 4.0 score of 9.4. The breach was present from August 26, 2024, until its recent fix. The solution was implemented directly on Docker Hub, obviating the need for user-side updates.
Potential Exploits and Security Measures
Due to the flaw, an attacker could create a PAT on a controlled account, convert this account into an organization, and assign another user as its owner. Consequently, the attacker could operate on the registry as the designated owner, with no notifications sent to the user about the change. This vulnerability enabled unauthorized actions such as pulling, pushing, or deleting images within the owner’s repositories.
Docker’s investigations revealed no exploit of this vulnerability. The company analyzed over 304,000 pushes associated with transferred tokens and found that they predominantly involved the same user or team owning both affected accounts. In cases with unconfirmed ownership, Docker conducted thorough checks to ensure no malicious activity occurred.
Notifications and User Precautions
On October 2, Docker alerted users whose accounts had received transferred tokens and organization owners via email, detailing the tokens’ descriptions and creation dates. Subsequently, Docker deactivated identified transferred tokens on October 8, except those requested for retention by their owners.
Users are advised to audit their PATs, revoking those unrecognized or unused, and to opt for organization access tokens for automation purposes. These tokens require specific subscriptions and management by an organization or company owner.
In response to this incident, Docker has updated its processes to require user consent before assigning organization ownership and ensures users are notified of changes. The company also maintains logs of all token ownership changes to prevent similar vulnerabilities in the future.
