Docker Hub flaw let attackers impersonate users, tamper with images
Summary
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that allowed attackers to impersonate users and tamper with container images. The flaw exploited personal access tokens (PATs) to gain unauthorized access to repositories.
IFF Assessment
This vulnerability allows attackers to impersonate users and tamper with container images, posing a significant risk to the integrity and security of deployed applications.
Severity
The vulnerability allows for unauthorized access to container repositories and tampering with images, indicating a high attack vector and significant impact on confidentiality and integrity, likely deserving a high CVSS score.
Defender Context
This critical vulnerability in Docker Hub highlights the importance of securing access tokens and continuously monitoring for unauthorized repository access. Defenders should ensure they are aware of the patch status for Docker Hub and review their internal processes for managing personal access tokens to prevent similar incidents.