Docker Patched Vulnerability Enabling Unauthorized Access
A flaw allowed attackers to hijack personal access tokens after a repository ownership transfer on Docker Hub.
Updated on Oct. 13, 2026 in Cybersecurity
Live Poll
Do you trust that major software platforms provide adequate security for your personal account credentials?
Docker has patched CVE-2026-105445, a vulnerability that allowed attackers to authenticate as target users by exploiting how Docker Hub handles repository ownership transfers. The flaw, which existed since August 26, 2024, has been mitigated after a fix was deployed on September 30, 2026.
Why it matters
This vulnerability highlighted a critical failure in identity management during organizational restructuring, potentially exposing repository contents to unauthorized actors. It underscores the security risks inherent in automated token reassignment processes within cloud-based container registries.
The vulnerability originated when a Docker Hub user converted an account to an organization and designated a target user as the owner. The system then reassigned the target user's existing personal access token to the new ownership structure without rotating the secret or requiring consent.
The players
Docker
A software company that provides a platform for developers to build, share, and run containerized applications.
Docker Hub
A hosted service by Docker that serves as a container registry for managing and distributing container images.
The details
The flaw in Docker Hub enabled attackers to gain unauthorized access by manipulating the ownership transfer workflow. When a target user was designated as an owner of a newly created organization account, the underlying architecture failed to invalidate or re-issue their personal access token—a string of characters used to authenticate API requests. This oversight allowed the organization to essentially inherit the target's authentication credentials.
Timeline
August 26, 2024: The vulnerability was introduced to the platform.
September 30, 2026: Docker received the report and deployed a fix to production.
October 2, 2026: Affected users and organization owners were notified.
October 8, 2026: Docker deactivated all transferred personal access tokens.
The Tech Race
This incident follows a pattern set by the 2023 GitHub personal access token exposure where automated identity reassignments led to credential leakage. It highlights an ongoing industry-wide race to harden identity and access management workflows against insecure administrative transitions.
Users who maintained organization-level repositories on Docker Hub during the affected period should check their audit logs for unexpected activity. Docker has already deactivated the specific tokens involved, requiring affected users to generate new credentials for their automated workflows.
The takeaway
The incident demonstrates that even established CI/CD platforms can have subtle flaws in identity reassignment logic. Users should prioritize the use of scoped tokens and implement regular rotation policies to limit the blast radius of any potential platform-level vulnerabilities.
Further reading
Learn more about the latest security advisories and platform defenses on the Cybersecurity hub.
Source note: This article includes information reported by Bleeping Computer.
Live Poll
Do you trust that major software platforms provide adequate security for your personal account credentials?
