Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
Docker Hub flaw allowed users to push images as others; fixed in September 2026.
Run Docker?
Get an email when a reviewed story names Docker, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical vulnerability in Docker Hub, present for over two years, allowed one user to push, pull, or delete container images as another user. The flaw, tracked as CVE-2026-105445 with a CVSS score of 9.4, was fixed on September 30, 2026. Docker found no evidence of exploitation but noted that malicious actors could have published compromised images under legitimate names.
The lesson from this incident
Full lessonA critical authentication or authorization flaw in Docker Hub permitted one authenticated user to push, pull, or delete container images belonging to another user, earning a CVSS score of 9.4. The vulnerability went undetected and unpatched for more than two years, representing a significant window of exposure in a widely trusted software supply chain platform. Had the flaw been exploited, adversaries could have silently injected malicious code into legitimate container images, potentially compromising thousands of downstream deployments. This incident highlights the danger of privilege boundary failures in shared, multi-tenant platforms where trust in publisher identity is foundational to security.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
Indicators of Compromise
- cve — CVE-2026-105445