Docker patches critical Docker Hub bug that allowed user impersonation

First reported by BleepingComputer at · Updated · 3 sources

Docker fixed the flaw, tracked as CVE-2026-105445, on September 30 and says it found no evidence of exploitation. According to The Hacker News, the bug sat in the feature that converts a personal account into an organization, and Docker published its advisory on October 12. It let one user push, pull or delete another's images.

  • Cyber Security News says personal access tokens transferred during account conversions were affected.
  • Attackers could publish container images under trusted names.
  • The Hacker News describes the flaw as two years old.

Covered by 3 publishers within 3 hours of the first report.

Reporting3

BleepingComputer Docker Hub flaw let attackers impersonate users, tamper with images · Bill Toulas
Cyber Security News Critical Docker Hub Flaw Lets Attackers Impersonate Users and Push Container Images · Guru Baran
The Hacker News Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another · info@thehackernews.com (The Hacker News)

Discussion

Hacker News 6 points, 0 comments