Docker Patched Critical Access Vulnerability
The company addressed a security flaw that allowed unauthorized repository access through personal access tokens.
Updated on Oct. 13, 2026 in Cybersecurity
Live Poll
Do you trust that major software platforms provide adequate security for your personal account credentials?
Docker has patched a critical vulnerability, tracked as CVE-2026-105445, which enabled unauthorized users to access repositories via personal access tokens. While the flaw allowed attackers to authenticate as target users, the company reports no evidence of exploitation.
Why it matters
The vulnerability could have permitted attackers to gain unauthorized access to private repositories by exploiting how Docker Hub reassigned personal access tokens during ownership changes. Securing these tokens is vital for protecting code integrity and sensitive data stored within software development environments.
The vulnerability affected personal access tokens that were reassigned without secret changes or consent. Docker examined 304,000 pushes for signs of exploitation.
The players
Docker
Docker is a prominent technology company that provides an open platform for developers to build, share, and run containerized applications.
The details
The flaw allowed attackers to create an account, convert it into an organization, and name a target user as the owner, causing the system to reassign the target's personal access token to the new owner without updating the secret. Docker deployed a fix to production on September 30, 2026, and officially deactivated the transferred tokens shortly thereafter.
Timeline
The vulnerability was first introduced into the system on August 26, 2024.
Docker received a report regarding the flaw and deployed a fix on September 30, 2026.
Affected users and organization owners were notified of the security issue on October 2, 2026.
The company deactivated all transferred personal access tokens on October 8, 2026.
The Tech Race
This incident highlights the security challenges inherent in the Docker Hub container registry as it manages high-volume automated deployments. The fix demonstrates a necessary evolution in how identity and access management systems protect shared developer resources.
Users who may have had their personal access tokens transferred are advised to rotate their credentials immediately to ensure account safety. Developers should audit their organization settings to verify that no unauthorized owners were added to their repositories.
The takeaway
Maintaining strict control over personal access tokens is essential for preventing unauthorized repository access. Regularly auditing user permissions and organization membership remains the best defense against token-based authentication flaws.
Further reading
Learn more about securing your infrastructure in our Cybersecurity section.
Source note: This article includes information reported by Bleeping Computer.
Live Poll
Do you trust that major software platforms provide adequate security for your personal account credentials?
