🔴 Critical: Docker Hub flaw let attackers impersonate users, tamper with images
-
Docker has disclosed a critical vulnerability tracked as CVE-2026-105445 in Docker Hub that could have allowed attackers to access another user's container repositories by abusing a personal access token (PAT). By exploiting the flaw, an attacker could effectively impersonate a legitimate user and interact with their repositories as if they were the account owner.
The most serious consequence is image tampering. Because access extended to repository contents, an attacker could potentially push modified images under a trusted account, opening the door to supply chain attacks against anyone pulling those images. This is especially concerning for organizations that rely on Docker Hub as part of their CI/CD pipelines or production deployments.
At this stage, no specific affected version ranges, indicators of compromise, or patch KB numbers have been provided in the disclosure. Administrators should review their Docker Hub access logs and audit personal access tokens for any unexpected or unauthorized activity.
Recommended steps:
- Rotate existing personal access tokens (PATs) and revoke any that are no longer needed
- Apply the principle of least privilege to token scopes, limiting write access where possible
- Review repository activity for unexpected pushes or tag changes
- Monitor Docker's official channels for further guidance and any patched releases
Source: Unknown
Has your organization reviewed its Docker Hub PAT scopes and repository activity since this disclosure?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login