Docker Hub Security Flaw Exposed User Container Image Access for Two Years

A critical security vulnerability, identified as CVE-2026-105445, was recently patched in Docker Hub after being present for over two years. The flaw could have allowed an attacker to push, pull, or delete container images as another user. This vulnerability originated from the account conversion feature within Docker Hub, which permits personal accounts to be transformed into organizational accounts. During this process, personal access tokens (PATs) were reassigned to the new organization owner without revoking or rotating the original token's secret, and without requiring confirmation from the named owner. This incident is highly significant for anyone utilizing Docker Hub, particularly those managing critical container images. The ability for a malicious actor to impersonate another user and manipulate container images poses a severe threat to software supply chain integrity and operational security. Developers and DevOps teams rely heavily on Docker Hub for distributing and deploying applications, making any compromise of this nature a direct threat to their workflows and the security of their deployed services. The extended period of exposure, from August 26, 2024, until the fix on September 30, 2026, is particularly concerning, as it provided a substantial window for potential exploitation. This event fits into a broader trend of increasing scrutiny on the security of core cloud-native infrastructure components. As organizations increasingly adopt containerization and microservices architectures, the security of container registries like Docker Hub becomes paramount. Recent years have seen a rise in supply chain attacks, where vulnerabilities in upstream components are exploited to compromise downstream systems. This Docker Hub flaw underscores the necessity for continuous security auditing, not just of application code, but also of the platforms and services that underpin modern software development and deployment. The move towards more secure-by-default configurations and enhanced transparency in vulnerability disclosures is a positive development, but the onus remains on practitioners to stay informed and implement best practices. In practice, this means that practitioners should immediately review their Docker Hub accounts, especially if they have undergone account conversions. It is crucial to audit existing PATs, revoke any that are no longer strictly necessary, and rotate others. Organizations should also enforce strict policies around PAT creation and usage, including least privilege principles and regular expiration. Furthermore, this incident highlights the importance of implementing robust image scanning and signing practices to verify the integrity and authenticity of container images before deployment, regardless of their source. While Docker has stated they found no evidence of exploitation, the potential impact necessitates a proactive and defensive stance from all users.