A Docker Hub flaw let attackers act as another user. Docker found no sign of abuse.
By Lior AharonovFounder, 7IT Solutions ·
Docker disclosed CVE-2026-105445 on 13 October 2026. When an account was converted into an organization, its personal access token was reassigned to the named owner without rotation or consent, so an attacker could name a victim as owner and use the token as that victim. Docker says it fixed this within four hours of a 30 September report and found no evidence of exploitation after checking 304,000 pushes.
A registry login is a publishing key. In the wrong hands, it could push an image under your name, and your customers would pull it. Docker rated this critical for that reason.
If Docker notified you on 2 October, review recent pushes and deletions in your repositories for anything you did not do. Create new access tokens where you still rely on them. Docker says that if you got no notice, you were not affected.
Registry tokens deserve the same care as production keys. Rotate them on a schedule, not after a notice.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.