Critical Docker Hub Vulnerability Exposed Personal Access Tokens for Two Years

Docker has recently disclosed and patched a critical vulnerability, identified as CVE-2026-105445, in its Docker Hub registry. The flaw, which was present for over two years (from August 26, 2024, until its fix on September 30, 2026), allowed personal access tokens (PATs) to be reassigned to a new owner during the conversion of a personal Docker Hub account into an organization. This meant that a PAT created by one user could, after such a conversion, effectively grant registry access under the identity of the newly designated organization owner, without their consent or notification. This vulnerability is significant for any practitioner relying on Docker Hub for image management and distribution. The ability for a PAT to impersonate another user within the registry poses a substantial software supply chain risk. An attacker exploiting this could potentially publish malicious images under a legitimate organization's name, severely compromising trust and integrity. While Docker states they found no evidence of exploitation, the potential for abuse was high, impacting any user who converted a personal account to an organization during the vulnerability's window. This incident fits into a broader trend of increasing scrutiny on software supply chain security and identity management in cloud-native environments. As organizations increasingly automate their CI/CD pipelines and rely on shared registries, the integrity of authentication mechanisms like PATs becomes paramount. The shift towards more granular, context-aware access controls and the principle of least privilege are critical. Recent supply chain attacks, often leveraging compromised credentials or insecure build processes, underscore the need for continuous vigilance and robust security practices beyond just container isolation. Docker's swift response and post-mortem analysis are positive, but the lengthy exposure window serves as a stark reminder of the subtle ways vulnerabilities can persist. In practice, developers and DevOps teams should immediately review their Docker Hub personal access tokens, revoking any that are unrecognized or no longer in use. For automated processes, the recommendation is to transition from personal PATs to organization-specific access tokens where available, as these can often be managed with greater oversight and lifecycle controls. Furthermore, this event highlights the importance of staying informed about security advisories from critical infrastructure providers like Docker and implementing regular security audits of container images and registry configurations. Organizations should also consider adopting tools that provide continuous scanning for vulnerabilities in their container images, both at rest and in use, to minimize their exposure to such risks.