[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1jL6EoSAdfkVG-FSfacp9eUmK1Fodts-_CENBlP-udk":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"e26f3e46-5277-4c62-b463-7ab8c1730acb","Docker Hub flaw let attackers impersonate users, tamper with images","docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images-2641e3","Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]","A critical vulnerability (CVE-2026-105445) in Docker Hub allowed attackers to impersonate users and tamper with container images. Attackers could convert their account to an organization, name a target user as owner, and then use the target's personal access token (PAT) to access their repositories. This posed a software supply chain risk by enabling the publishing of malicious images under a legitimate name. Docker has since fixed the flaw and found no evidence of exploitation.","Docker Hub flaw allowed attackers to impersonate users and tamper with images.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fdocker-hub-flaw-let-attackers-impersonate-users-tamper-with-images\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F13\u002Fdocker.jpg","2026-10-13T15:20:20+00:00","2026-10-13T16:00:14.286147+00:00",8,[17,20,23,25],{"name":18,"type":19},"Docker Hub","product",{"name":21,"type":22},"container images","technology",{"name":24,"type":22},"personal access token",{"name":26,"type":22},"software supply chain","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":51,"context":52},"cve","CVE-2026-105445","Docker Hub vulnerability allowing user impersonation and image tampering.",[18],{"controls":55,"vendors":141},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":86,"name":87,"problem":88,"products":89},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":115,"name":116,"problem":117,"products":118},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[119,125,133],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":158},"docker-hub-flaw-enabled-image-tampering-and-user-impersonation","Docker Hub Flaw Enabled Image Tampering and User Impersonation","A critical vulnerability in Docker Hub allowed attackers to hijack a target's identity by converting their own account into an organization, appointing the victim as owner, and then leveraging the victim's Personal Access Token (PAT) to publish malicious container images under a trusted name. This attack required no exploitation of the victim's credentials directly — only the structural flaw in how Docker Hub handled account-to-organization conversions and token scope. The supply chain implications are severe: developers and organizations consuming those images would have had no obvious indication that the images were tampered with. This incident underscores the danger of implicit trust placed in registry identities and the need to continuously validate the integrity of third-party software artifacts.",[147,148,149,150,151,152,153,154,155,156,157],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","SLSA Supply Chain Levels for Software Artifacts (Levels 1–4)","SSDF (NIST SP 800-218): Secure Software Development Framework — PW.4, RV.1","GDPR Article 32: Security of Processing (integrity of software in data processing pipelines)",{}]