Docker Hub Flaw Let Attackers Impersonate Users and Tamper With Container Images
Summary
A critical Docker Hub flaw let attackers reassign a personal access token to impersonate an organization owner and alter their container images. Docker fixed the issue and says it found no evidence of exploitation.
Key points
- Attackers could create an account and personal access token, convert the account into an organization, and name a target user as its owner; Docker Hub transferred the token without changing its secret or getting the target’s consent.
- The reassigned token could let attackers pull, push, or delete images within its scope, including publishing images under a legitimate name.
- The flaw did not grant Docker Hub web access or let attackers change passwords, email addresses, or two-factor settings.
- Docker introduced the flaw on August 26, 2024, confirmed a report on September 30, 2026, and deployed a fix less than four hours later.
- Docker found no evidence of exploitation after reviewing 304,000 pushes made with transferred tokens and analyzing high-risk public images.
- Docker notified affected users and organization owners on October 2 and deactivated transferred tokens on October 8, except where owners requested to retain them. PATs are no longer transferred during organization conversion, and owner designation now requires consent.
Article Details
- Vulnerability Types
- Personal access token reassignment enabling user impersonation and unauthorized access to container repositories
- Severity
- Critical
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available