CVE-2026-105445: Docker Hub Patched Critical Token Hijacking Flaw After Two-Year Exposure

Docker disclosed a critical vulnerability, tracked as CVE-2026-105445, that enabled attackers to impersonate users on Docker Hub by exploiting how personal access tokens were handled during account conversions. The flaw allowed unauthorized access to container repositories, posing a significant risk to software supply chains.

The vulnerability stemmed from Docker Hub reassigning a personal access token to a new organization owner without changing the token’s secret or obtaining consent. According to BleepingComputer, an attacker could create an account, generate a token, and convert it into an organization named after a target user. This allowed the attacker to authenticate as the victim using the original token secret.

Context and Background

Docker Hub is an online registry for storing and sharing container images. Personal access tokens serve as secrets for authenticating tools and workflows, allowing users to pull, push, or delete images. The flaw was introduced on August 26, 2024, when the conversion process began reassigning tokens to new owners without revoking the original secrets.

Docker received a report describing the issue on September 30, 2026. The company confirmed the vulnerability and deployed a fix to production less than four hours later. The exposure window lasted from August 26, 2024, at 20:33 UTC, until September 30, 2026, at approximately 19:10 UTC, according to Cyber Security News.

Who Is Affected

Users and organization owners whose accounts were involved in conversions during the exposure window were affected. Docker notified impacted users on October 2, 2026. On October 8, the company deactivated transferred personal access tokens, except for those whose owners explicitly requested to retain them.

Docker examined 304,000 pushes made with transferred tokens and analyzed high-risk public images. The company stated it found no evidence of exploitation. However, the flaw did not provide web access or allow attackers to change passwords, email addresses, or two-factor authentication settings.

Defender's checklist

Organizations should review their container image registries for any unexpected changes or unauthorized pushes. Security teams should audit personal access tokens and ensure they are rotated regularly. Monitor logs for authentication attempts using tokens that may have been transferred or compromised.

Operational impact

Teams usually need to verify the integrity of all container images published during the exposure window. Check whether any build pipelines or CI/CD systems used tokens that might have been affected by account conversions. Inform development and security teams about the risk of impersonation. Ensure that token permissions are strictly limited to necessary actions. Review access controls for organization ownership changes.

Background: Unauthorized access

Unauthorized access means any entry into a system, network, or physical space by a person who lacks explicit permission. It occurs when attackers bypass identity verification or exploit misconfigurations. You stop it by enforcing least privilege, monitoring logs for anomalies, and separating administrative duties from daily operations.

Read the full guide: Unauthorized Access Meaning: How Intruders Bypass Controls

What to do and how to stay safe: Docker

• Audit all personal access tokens in use for container registries and rotate them immediately.
• Verify the integrity of container images pulled or pushed during the vulnerability window.
• Monitor authentication logs for unusual activity or unauthorized access attempts.
• Once the vendor provides an update, ensure all systems are patched and configurations are reviewed.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did attackers exploit the Docker Hub vulnerability?

Docker found no evidence of exploitation after analyzing 304,000 pushes and high-risk images.

What could attackers do with the stolen tokens?

Attackers could pull, push, or delete images in target repositories and organizations where the target had access.

When was the vulnerability fixed?

Docker deployed a fix to production on September 30, 2026, less than four hours after confirmation.