# CVE-2026-105445: Docker Hub Flaw Enables User Impersonation, Supply Chain Risk > Critical flaw CVE-2026-105445 in Docker Hub allowed attackers to impersonate users via PAT reassignment, posing a software supply chain risk. - Published: 2026-10-13T15:26:01.000Z - Severity: critical - Category: Vulnerabilities - Tags: Docker Hub, Software Supply Chain, Container Security, CVE-2026-105445, User Impersonation - CVEs: CVE-2026-105445 - Author: Runtime Rebel Intel - Primary source: https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/ - Canonical: https://runtimerebel.com/blog/cve-2026-105445-docker-hub-flaw-enables-user-impersonation-supply-chain-risk ## Key points - Attackers could impersonate Docker Hub users via personal access token (PAT) reassignment, enabling image tampering and supply chain risks. - Affected systems: Docker Hub, specifically when converting accounts to organizations and reassigning PATs introduced on August 26, 2024. - Remediation: Docker has deployed a fix, deactivated transferred PATs, and now requires user consent for organization ownership transfers. ## Docker Hub Critical Flaw ([CVE](/glossary#cve)-2026-105445) Exposed Supply Chain to User Impersonation A critical [vulnerability](/glossary#vulnerability), identified as [CVE-2026-105445](https://nvd.nist.gov/vuln/detail/CVE-2026-105445), was recently disclosed in Docker Hub, a widely used online registry for container images. This flaw allowed attackers to impersonate legitimate users and potentially tamper with container images, posing a significant software supply chain risk. Discovered and fixed by Docker, the vulnerability stemmed from an issue with personal access token (PAT) reassignment during account conversion processes, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/). ## Technical Details of CVE-2026-105445 Docker Hub PAT Reassignment The core of CVE-2026-105445 lay in how Docker Hub handled the conversion of a user account into an organization. When an attacker created an account, generated a personal access token (PAT) for it, and then converted that account into an organization, they could designate a target user as the new organization's owner. The critical misstep occurred because Docker Hub would reassign the attacker's PAT to the newly designated target owner without changing the PAT's secret or requiring the target's consent. This reassignment meant the attacker's original PAT, still in their possession, effectively became a valid authentication token for the target user. Consequently, within the scope of that PAT's permissions and the target user's access, the attacker could perform actions as the target. These actions included pulling, pushing, or deleting images within the target's repositories and any organizations where the target had access. Docker explicitly stated this "acted as the target user at the registry level," highlighting the severity of the control transfer. The vulnerability was introduced on August 26, 2024, when this particular PAT reassignment behavior began without adequate security controls. ### Impact and Supply Chain Implications The potential for user impersonation via CVE-2026-105445 carried substantial implications for software supply chain security. By gaining the ability to push images under a legitimate user's name, an attacker could introduce malicious or compromised container images into workflows and systems relying on those legitimate repositories. This could lead to a widespread compromise of downstream applications and services. While Docker noted the flaw did not grant full Docker Hub web access or allow attackers to change passwords or [2FA](/glossary#two-factor-authentication-2fa) settings, preventing complete account takeover, the ability to manipulate registry-level operations on container images is a severe risk. Such an attack could undermine trust in widely used container images and compromise the integrity of software deployments. ## Mitigation and Defender Guidance for Docker Hub Security Best Practices For defenders concerned about Docker Hub security best practices, understanding the specifics of this vulnerability is key. Docker acted swiftly upon receiving the vulnerability report on September 30, 2026, deploying a fix within four hours. They also examined 304,000 pushes made with transferred tokens and analyzed high-risk public images, finding no evidence of in-the-wild exploitation. Docker notified affected users and organization owners on October 2, and all transferred PATs (except those explicitly requested to be retained) were deactivated on October 8. Users who did not receive a notification should assume they were not impacted and no further action is needed from their side. ### Timeline and Remediation for CVE-2026-105445 Exploitation * **August 26, 2024:** Vulnerability introduced due to PAT reassignment without revocation or consent during account-to-organization conversion. * **September 30, 2026:** Docker received a vulnerability report. * **September 30, 2026 (within 4 hours):** A fix was deployed to production. * **October 2, 2026:** Affected users and organization owners were notified. * **October 8, 2026:** Transferred PATs were deactivated, with exceptions for explicit retention requests. The platform no longer transfers PATs during conversion and now explicitly requests user consent before naming someone an organization owner. This comprehensive remediation for [CVE-2026-105445 exploitation](https://nvd.nist.gov/vuln/detail/CVE-2026-105445) addresses the root cause and significantly reduces the risk of similar impersonation attacks. Organizations are always advised to review their Docker Hub access tokens regularly and enforce the principle of [least privilege](/glossary#least-privilege) for all PATs. **Related:** [CISA's Updated SBOM Guidance: Enhancing Software Supply Chain Transparency](/blog/cisa-s-updated-sbom-guidance-enhancing-software-supply-chain-transparency), [FakeGit Campaign Exploits GitHub for SmartLoader Malware](/blog/fakegit-campaign-exploits-github-for-smartloader-malware) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-105445-docker-hub-flaw-enables-user-impersonation-supply-chain-risk