> ## Content Index > Fetch the complete content index at: https://www.stirup.si/llms.txt > Use this file to discover other available public pages before exploring further. # Docker Hub Vulnerability Allows Unauthorized Image Manipulation - URL: https://www.stirup.si/docker-hub-vulnerability-allows-unauthorized-image-manipulation-f459c592/ - Published: 2026-10-13T19:08:43.000Z - Updated: 2026-10-13T19:08:43.000Z - Description: A critical vulnerability in Docker Hub, identified as CVE-2026-105445, allowed attackers to impersonate users and manipulate container images by reassigning personal access tokens without consent. - Author: Satish Das - Tags: Security, Analysis, Stirup Research ## Description of the Vulnerability and Its Impact A critical vulnerability in Docker Hub, identified as CVE-2026-105445, allowed attackers to impersonate other users and manipulate container images. The flaw stemmed from Docker Hub reassigning a personal access token (PAT) to a designated organization owner without changing its secret or obtaining the target's consent, as noted by Bill Toulas. This enabled unauthorized users to push, pull, or delete images on behalf of others, posing significant risks to image integrity and user trust. The vulnerability, which existed for over two years, highlights the importance of secure token management in cloud-based registry systems. Docker has since released a fix to address the issue, though the exact timeline for patching remains unspecified. The flaw underscores the need for continuous security audits in platforms handling sensitive software artifacts. ## Timeline of the Flaw and Its Fix Docker addressed a critical security flaw in its Hub service on September 30, 2026, after receiving a vulnerability report that described the issue. The flaw, which had existed for over two years, allowed one user to push images as another, potentially compromising the integrity of container images. According to Docker, the vulnerability was introduced on August 26, 2024, when a conversion process began reassigning personal account PATs (Personal Access Tokens) to new owners. Docker confirmed the issue and deployed a fix to production within less than four hours of receiving the report. The company stated that it found no evidence of exploitation at the time of the fix. This rapid response highlights Docker's commitment to addressing security concerns promptly once they are identified. ## Mitigation and Post-Exploitation Actions In response to the critical vulnerability in Docker Hub, mitigation efforts focused on identifying and neutralizing potential risks. Docker analyzed the highest-risk public images without executing them, finding no evidence of malware or tampering, as reported by the company. Additionally, Docker examined 304,000 pushes made using transferred personal access tokens (PATs) and found no signs of exploitation. To address the flaw, affected users and organization owners were notified on October 2, and transferred PATs were deactivated on October 8, with exceptions made for those who explicitly requested retention. These actions were taken to prevent unauthorized image pushes and ensure the integrity of the Docker Hub ecosystem. Docker emphasizes that these steps were part of a broader effort to secure the platform following the discovery of the two-year-old flaw. ## Changes in Docker's Security Policies Docker has updated its security policies to address concerns related to user permissions and authentication on its Hub platform. The changes include requiring explicit consent before naming a user an organization owner and notifying the user when this occurs, as stated in evidence [The Hacker News](https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html?ref=stirup.si) and [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/?ref=stirup.si). Additionally, the platform no longer transfers personal access tokens (PATs) during conversion, enhancing account security. These updates aim to improve transparency and reduce the risk of unauthorized actions. While the specific details of the vulnerability are not provided in the evidence, the changes reflect Docker's efforts to strengthen its security framework. For further insights on AI-powered attack defense, a digital summit featuring Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian is available, as noted in [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/?ref=stirup.si). ## User Response and Verification Efforts In response to the Docker Hub vulnerability, users have taken steps to verify the integrity of their images. One user reported rotating their two CI tokens and examining the signatures of their 42 published images, tracing each to the CI run that built it. Docker has also conducted an analysis of 304,000 pushes made with transferred tokens and reviewed high-risk public images, finding no evidence of exploitation, according to the company. Docker advises users who did not receive a notification to assume they were not impacted and did not need to take any action. These verification efforts highlight the importance of proactive security measures in container management. Users are encouraged to follow Docker’s guidance and continue monitoring their repositories for any unusual activity. ## Sources and reporting notes - [The Hacker News](https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html?ref=stirup.si) - [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/?ref=stirup.si) Based on published source material. No independent hands-on testing is claimed.