Docker Hub Flaw Allowed Cross-User Image Manipulation for Over Two Years
A critical authentication or authorization flaw in Docker Hub permitted one authenticated user to push, pull, or delete container images belonging to another user, earning a CVSS score of 9.4. The vulnerability went undetected and unpatched for more than two years, representing a significant window of exposure in a widely trusted software supply chain platform. Had the flaw been exploited, adversaries could have silently injected malicious code into legitimate container images, potentially compromising thousands of downstream deployments. This incident highlights the danger of privilege boundary failures in shared, multi-tenant platforms where trust in publisher identity is foundational to security.
Tactical Insight
Immediate actions
- Audit all recently pulled Docker Hub images against their expected SHA256 digest to verify integrity and detect any unauthorized modifications.
- Update Docker Hub integrations, credentials, and CI/CD pipeline configurations to ensure you are operating against the latest patched platform version.
- Review access logs for anomalous push/pull/delete activity on your organization's repositories for the past two years.
Supply chain hardening
- Enforce image digest pinning (rather than mutable tags) in all Dockerfiles and deployment manifests to detect tampering.
- Implement a private, internal container registry as a trusted mirror to reduce reliance on public hub availability and integrity.
- Integrate container image signing using tools such as Sigstore/Cosign or Docker Content Trust to cryptographically verify publisher identity.
Detection & monitoring
- Enable and centralize audit logging for all container registry operations, alerting on unexpected image mutations or deletions.
- Deploy software composition analysis (SCA) and container scanning tools in CI/CD pipelines to flag newly introduced vulnerabilities or suspicious layers in pulled images.
- Establish a process to subscribe to CVE feeds and vendor security advisories for all critical SaaS and platform dependencies.