Docker Fixes Critical Hub Flaw That Let Users Push Images as Others
Summary
A Docker Hub flaw let users’ personal access tokens act as another user’s, enabling registry access to their images. Docker fixed it on September 30, found no evidence of exploitation, and deactivated identified transferred tokens.
Key points
- The flaw, tracked as CVE-2026-105445 and rated critical with a CVSS 4.0 score of 9.4, was open from August 26, 2024, until Docker fixed it on September 30, 2026.
- Converting a personal account to an organization transferred its personal access tokens to the named owner without changing the token secrets or requiring the owner’s confirmation.
- A transferred token could access Docker Hub’s registry with the owner’s permissions, including pushing, pulling, or deleting images in repositories the owner could access; it did not enable web-interface access or account takeover.
- Docker says it found no evidence of exploitation after reviewing conversions and about 304,000 pushes made with transferred tokens. Its advisory does not report findings for pulls or deletions.
- Docker emailed affected users and organization owners on October 2 and deactivated identified transferred tokens on October 8, except those users asked to keep.
- Docker advises users to review and revoke unrecognized or unused tokens and use organization access tokens for organizational automation. It now requires consent when naming an organization owner and notifies that user.
Article Details
- Vulnerability Types
- Personal access token ownership-transfer flaw enabling registry actions as another user
- Severity
- Critical; CVSS 4.0 score 9.4
- Affected Versions
- Docker Hub was vulnerable from August 26, 2024, until the fix on September 30, 2026.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Review personal access tokens and revoke any that are unrecognized or no longer used.
- Use organization access tokens, rather than an individual's personal access token, for automation belonging to an organization.
CVE
People
Krisztian HozakCo-discovered the flaw with Peter Molnar and reported it to Docker.Peter MolnarCo-discovered the flaw with Krisztian Hozak and reported it to Docker.Todd MatensReported receiving Docker emails about transferred tokens; he rotated two CI tokens and checked signatures on his published images.