Critical Docker Hub Vulnerability Allows User Impersonation

Docker disclosed a critical CVE-2026-105445 in Docker Hub that could let attackers impersonate users and access container repositories by converting personal accounts into organizations and assigning target users as owners, enabling unauthorized use of PATs; Docker confirmed the issue on September 30, 2026, deployed a fix the same day, notified users, deactivated transferred PATs, and reported no evidence of exploitation after reviewing ~304,000 pushes.