Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Docker Hub PAT reassignment flaw (CVE-2026-105445)

Vulnerability
First reported
Last updated
Happening score
H score 1
1 unique sources, 1 articles

Summary

Hide ▲

Docker Hub disclosed CVE-2026-105445, a critical vulnerability that let an attacker reassign a personal access token (PAT) and act as another user at the registry level. The flaw could expose container repositories to unauthorized pull, push, and delete actions across affected repositories and accessible organizations. Docker said it treated the issue as a software supply chain risk and deployed a fix quickly, but it found no evidence of exploitation after review.

Related Happenings

Cloudflare Containers and Sandboxes shared-disk reuse security flaw

Vulnerability
H score3 First: 25.09.2026 07:49 Last: 25.09.2026 07:49 Sources 1

About this happening: Cloudflare fixed a shared-disk reuse flaw in Cloudflare Containers and Cloudflare Sandboxes that let one customer read leftover data from other tenants on shared...

Open Happening

CISA orders federal mitigation of CVE-2026-16812

Public Sector Action
H score36 First: 28.07.2026 01:49 Last: 28.07.2026 01:49 Sources 1

About this happening: CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog and ordered U.S. federal civilian executive branch agencies to mitigate it by July 30, 2...

Open Happening

Terrarium CVE-2026-5752 mitigation guidance

Advisory/Mitigation
H score39 First: 22.04.2026 10:16 Last: 22.04.2026 10:16 Sources 1

About this happening: CERT/CC issued mitigation guidance for Terrarium deployments exposed to CVE-2026-5752, a sandbox-escape flaw that can lead to root code execution. The advice i...

Open Happening

TeamPCP infostealer in compromised Trivy Docker Hub images

Malware Activity
H score37 First: 23.03.2026 17:05 Last: 23.03.2026 17:05 Sources 1

About this happening: TeamPCP infostealer was found in additional compromised Trivy Docker images, extending the malware distribution path through Docker Hub. The newly identified tags 0....

Open Happening

Timeline

  1. 13.10.2026 18:20 1 articles · 2h ago

    Docker Hub reassigns transferred PATs to new organization owners

    Technical Analysis Update

    On August 26, 2024, Docker Hub began reassigning a personal access token (PAT) to a new organization owner during account conversion without changing the secret or obtaining consent. That behavior created CVE-2026-105445 and allowed a transferred PAT to act as the target user at the registry level, with potential access to pull, push, or delete images in the target's repositories and accessible organizations.

    Show sources
    Open in new tab
  2. 13.10.2026 18:20 1 articles · 2h ago

    Docker notifies affected Docker Hub users and organization owners

    Victim Impact Update

    On October 2, 2026, Docker notified affected Docker Hub users and organization owners about transferred PATs associated with the flaw. Docker said users who did not receive a notification should assume they were not impacted and did not need to take any action.

    Show sources
    Open in new tab
  3. 13.10.2026 18:20 1 articles · 2h ago

    Docker deactivates transferred PATs and stops PAT transfer during conversion

    Mitigation Patch Update

    On October 8, 2026, Docker deactivated transferred PATs except for owners who explicitly requested to retain them. Docker also stopped transferring PATs during conversion and now requests user consent before naming an organization owner.

    Show sources
    Open in new tab
  4. 13.10.2026 03:00 2 articles · 17h ago

    Docker receives a report of CVE-2026-105445 and deploys a production fix

    Initial Disclosure

    On September 30, 2026, Docker received a vulnerability report describing CVE-2026-105445, confirmed the issue, and deployed a fix to production less than four hours later. Docker also said it found no evidence of exploitation after examining 304,000 pushes made with transferred tokens and analyzing high-risk public images.

    Show sources
    Open in new tab