Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

What happened?

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that converts a personal account into an organization, Docker said in a security advisory on October 12.

Key details

• A Docker Hub flaw let one user push, pull, or delete container images as another user by transferring personal access tokens during account conversion.
• The vulnerability existed in the feature that converts a personal account into an organization, which transferred PATs to the designated organization owner.
• Docker tracked the flaw as CVE-2026-105445 with a CVSS 4.0 score of 9.4 and rated it critical due to the ability to publish images under legitimate names.
• The flaw was open from August 26, 2024 until September 30, 2026, a period of a little over two years.
• Researchers Peter Molnar and Krisztian Hozak discovered and reported the flaw, naming it GhostPat, and reproduced it on consenting test accounts.
• Docker notified affected users and organization owners on October 2, deactivated transferred tokens on October 8, and now requires consent before naming organization owners.

Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.