<![CDATA[🔴 Critical: Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another]]>A critical flaw in Docker Hub, the registry used to publish and download container images, allowed one user to push, pull, or delete images while authenticated as another user. Docker fixed the flaw on September 30 and stated that it found no evidence of exploitation in the wild.

According to a security advisory published on October 12, the issue resided in the feature that converts a personal account into an organization. The vulnerability had reportedly existed for roughly two years before being addressed.

Key points:

  • Docker Hub users could potentially act on images under another user's identity due to the flaw.
  • The vulnerability was tied to the personal-to-organization account conversion feature.
  • Docker patched the issue on September 30.
  • A security advisory was published on October 12.
  • Docker says it has no evidence that the flaw was exploited.

No specific CVE ID or advisory identifier was provided in the source article. Administrators and users who rely on Docker Hub for image distribution should review the advisory and ensure their workflows align with Docker's current guidance.

Source: The Hacker News

Has your organization reviewed its Docker Hub account and organization conversion settings since this advisory was published?

]]>https://xploitlk.com/topic/739/critical-docker-fixes-critical-two-year-old-hub-flaw-that-let-one-user-push-images-as-anotherRSS for NodeTue, 27 Oct 2026 07:48:56 GMTMon, 19 Oct 2026 06:30:17 GMT60