Docker Hub flaw let attackers impersonate users, tamper with images

Docker disclosed a critical vulnerability tracked as CVE-2026-105445 affecting Docker Hub, the widely used container image registry. The flaw allowed attackers to access another user's container repositories by leveraging a personal access token (PAT). This could enable malicious actors to impersonate legitimate users and tamper with container images. Such an attack could have serious supply chain implications, as compromised images could be distributed to downstream users and systems. The vulnerability was classified as critical given the potential for widespread impact across containerized environments. Docker has since disclosed the issue, implying a patch or mitigation has been or is being made available.