Docker Hub Flaw Exposes Container Image Repositories to Unauthorized Access

A critical vulnerability, CVE-2026-105445, was discovered and patched in Docker Hub, the widely used registry for container images. The flaw allowed an attacker to gain unauthorized access to another user's container image repositories by exploiting a weakness in how personal access tokens (PATs) were handled during the conversion of a personal account to an organizational account. Specifically, when an account was converted, its existing PATs were reassigned to the new organization owner without revoking the original secret or requiring the new owner's consent. This meant an attacker could create a PAT on an account they controlled, convert that account to an organization, name another user as the owner, and then use the original PAT to act as the newly designated owner within the registry. This vulnerability is significant for practitioners because it directly impacts the integrity and security of their container image supply chain. Unauthorized access to image repositories could lead to malicious image injection, tampering, or deletion, potentially compromising entire applications and infrastructure. While Docker has stated they found no evidence of exploitation after reviewing affected accounts and pushes, the potential for such an attack highlights the constant need for vigilance in securing containerized environments. Developers and operations teams rely heavily on Docker Hub for distributing and consuming container images, making any compromise a serious threat to their operations and the trust in their deployed applications. The incident fits into a broader trend of increasing scrutiny on software supply chain security and the critical role of registries and artifact management. As container adoption continues to grow, with Kubernetes being used by over 80% of container users, the attack surface for container-related infrastructure expands. Recent years have seen a rise in sophisticated attacks targeting various stages of the software development lifecycle, from source code to deployment. This Docker Hub vulnerability echoes concerns seen in other areas of cloud-native security, where misconfigurations or overlooked edge cases in identity and access management can have far-reaching consequences. The industry is continuously working towards more secure defaults and robust verification mechanisms, but the onus remains on practitioners to understand and mitigate these risks. In practice, this means that while Docker has patched the vulnerability, practitioners should review their own security posture. This includes auditing permissions for Docker Hub organizations, especially those that have undergone account type conversions. Implementing stricter access controls, regularly rotating PATs, and leveraging image scanning tools to detect any unauthorized modifications to images are crucial steps. Furthermore, integrating security checks earlier in the CI/CD pipeline can help catch potential issues before they reach production. Teams should also stay informed about security advisories from their container registry providers and promptly apply any recommended updates or mitigations. This event serves as a reminder that even foundational services in the container ecosystem require continuous security diligence.