Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

Summary: A flaw in Docker Hub's account-to-organization conversion feature let one user push, pull, or delete images as another user by transferring personal access tokens to a newly named organization owner without that owner's consent or notification. Docker fixed the flaw on September 30, tracked it as CVE-2026-105445 with a CVSS 4.0 score of 9.4, and said it found no evidence of exploitation after reviewing about 304,000 pushes made with transferred tokens during a window that ran from August 26, 2024.
Why it matters: Docker rated the flaw critical because the access included publishing images under a legitimate name - the same mechanism attackers used in March and April with stolen publisher credentials to push malicious Trivy and KICS images to the publishers' own repositories. Docker's registry logs record when a token is used, not that it exists, so a transferred token that was never used left no record, and the company treated every token transferred during the two-year window as possibly affected.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-105445
Related: ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026