Docker Hub Breach: User Impersonation and Image Tampering Exploit

How the Breach Occurred

A critical security flaw, identified as CVE-2026-105445, was discovered in Docker Hub, a widely used online registry for storing and sharing container images. The vulnerability allowed malicious actors to gain unauthorized access to other users' container repositories. The attack vector involved an attacker creating their own Docker Hub account and a personal access token (PAT). They would then convert this account into an organization and designate a target user as the organization's owner. The core of the exploit lay in Docker Hub's flawed process of reassigning a PAT to a new organization owner without revoking the token's secret or obtaining explicit consent from the designated owner. This allowed the attacker to use the reassigned PAT to authenticate as the targeted user.

What Data Was Exposed & Consumer Risks

• **Unauthorized Access to Repositories:** Attackers could access, pull, push, or delete container images within the target user's repositories and any organizations where the target had access.
• **Software Supply Chain Risk:** The ability to push malicious or altered images under a legitimate user's name represents a significant software supply chain risk, potentially compromising downstream users and applications.
• **Impersonation:** Attackers could effectively impersonate legitimate users at the registry level, making it difficult to distinguish between authentic and malicious activity.
• **Limited Scope of Impact:** Importantly, the vulnerability did not grant attackers access to the Docker Hub web interface, nor did it allow them to change user passwords, email addresses, or two-factor authentication settings, thus preventing account lockout or direct credential theft.

Protective Steps for Affected Consumers

Docker has since deployed a fix for this vulnerability and has taken steps to mitigate the impact. Users who received notifications from Docker were informed that their transferred PATs were deactivated, unless they explicitly requested to retain them. Docker has also updated its process to require user consent before naming them an organization owner and no longer transfers PATs during account conversions. While Docker found no evidence of widespread exploitation after an investigation, users who believe they may have been affected or wish to enhance their security posture should consider the following general best practices for managing credentials and monitoring their accounts:

• **Review and Rotate Access Tokens:** Regularly review all active personal access tokens and API keys associated with your Docker Hub account and any other cloud services. Rotate any tokens that have been active for an extended period or that you no longer actively use.
• **Enable Multi-Factor Authentication (MFA):** Ensure that MFA is enabled on your Docker Hub account and all other critical online services. This adds an essential layer of security beyond just a password.
• **Monitor Repository Activity:** Keep a close eye on your Docker Hub repositories for any unusual or unauthorized activity, such as unexpected image pushes, pulls, or deletions.
• **Stay Informed:** Follow official security advisories from Docker and other service providers to stay aware of potential vulnerabilities and recommended actions.