Docker Hub Flaw Let One User Impersonate Another; Fixes Made After Two Years

· Cybersecurity · United States

Docker disclosed a critical vulnerability, CVE-2026-105445, in Docker Hub, the registry where container images are published and downloaded. The flaw let one user push, pull or delete images as another user by abusing a personal access token, and it stemmed from the feature that converts a personal account into an organization. Docker fixed the flaw on September 30 and said it found no evidence that anyone exploited it. Separately, GitHub moved to tighten npm publishing after researchers found that an attacker could push new versions of a different user's package without stealing credentials, leaving more than 1,500 packages vulnerable to hijacking. GitHub now expires unvalidated npm trusted publishing configurations 48 hours after creation. Both cases spotlight the shared registries and package feeds that software supply chains depend on.

Why it matters：Registries and package feeds are single points of trust for the software supply chain, so impersonation or hijacking flaws there can let attackers tamper with code used across many organizations at once.

Key points

  • Docker Hub flaw CVE-2026-105445 allowed image impersonation via a personal access token.
  • Docker fixed it on September 30 and found no evidence of exploitation.
  • GitHub now expires unvalidated npm trusted publishing configs after 48 hours; 1,500+ packages were at risk.

Sources (original reporting)

More stories from this day