Essential Insights
- A critical vulnerability in Docker Hub allowed attackers to transfer personal access tokens between accounts during conversion, enabling unauthorized image pull, push, and delete actions with high privilege.
- Attackers could exploit this flaw by creating tokens, converting accounts to organizations, and assigning ownership without user consent or notification, risking the publication of malicious images under legitimate names.
- Despite no evidence of exploitation, the flaw posed a significant threat to image integrity and account security, leading Docker to deactivate identified tokens and advise thorough review and revocation of suspicious credentials.
Threat, Attack Techniques, and Targets
The main threat was a critical flaw in Docker Hub, a platform where container images are shared. This flaw allowed a user to push, pull, or delete images as another user. It existed in the feature that turns a personal account into an organization account. During conversion, personal access tokens (PATs) were transferred to a new owner without proper checks. An attacker could exploit this by creating a controlled account, converting it into an organization, and assigning another user as the owner. This would give the attacker access to the victim’s images and repositories within the registry. The vulnerability was active from August 26, 2024, for just over two years. Docker identified this flaw as CVE-2026-105445 and rated it as critical with a CVSS score of 9.4. The attack techniques primarily involved abusing the account conversion process to gain unauthorized access.
The targets included Docker Hub users and organizations that used personal account conversions. Attackers could have moved images or deleted data, gaining unauthorized control over repositories. The attack was limited to the registry and did not affect the web interface, account passwords, email addresses, or two-factor authentication settings.
Impact, Security Implications, and Remediation Guidance
This flaw posed serious security risks. It allowed attackers to publish images under a user’s or organization’s name without permission. During the open period, malicious actors did use stolen credentials to push harmful images to Docker repositories. However, Docker’s review found no evidence of exploitation during the vulnerability’s duration. All account conversions during this time were checked, and no signs of malicious activity were detected.
The security implications include potential image tampering and impersonation. This could lead to supply chain risks or the spread of malicious containers. Docker fixed the flaw on September 30, 2024, and advised users to review their tokens. Users should revoke unknown or unused tokens and consider switching to organization access tokens. In case of suspicious activity, users are instructed to check account settings, token creation dates, and activity logs.
For remediation guidance, users should consult Docker’s official documentation or contact relevant security authorities. Docker recommends reviewing your tokens, revoking any unknown tokens, and using organization-managed tokens for automation. Since this flaw was fixed competitively, no additional updates are needed, but ongoing vigilance and review are essential to maintain security.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
