Docker has disclosed a critical vulnerability in Docker Hub, tracked as CVE-2026-105445. The flaw allowed attackers to access another user's container repositories using a personal access token (PAT), potentially letting them impersonate the account owner and tamper with images stored there.
Because Docker Hub is a central distribution point for container images, an access-control flaw of this kind can have serious supply-chain implications. An attacker who gains write access to a repository could modify images that downstream users may later pull and run.
The disclosure highlights the risk that personal access tokens can pose when they are not properly scoped or protected. Docker has not yet detailed a fix, but the vulnerability underscores how important token security is for anyone publishing container images.