Docker Hub PAT authentication allows cross-user repository access
Critical Docker Hub flaw let any PAT holder push, pull, or delete images in another user's repositories. Fixed September 30, 2026. CVSS 9.8.
- Vendor
- Docker
- Product
- Docker Hub
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-105445 is a critical authentication flaw in Docker Hub that let any authenticated user push, pull, or delete container images in another user’s repositories using a personal access token (PAT). The flaw affected Docker Hub’s PAT-based authorization layer: tokens were meant to grant access only to the issuing account’s repositories, but the access-control logic did not enforce that boundary.
Docker patched the vulnerability on September 30, 2026. The flaw had been present for approximately two years before discovery. Docker has not confirmed exploitation in the wild, and the CVE does not appear on CISA’s Known Exploited Vulnerabilities catalog as of this writing.
Affected product: Docker Hub (cloud-hosted registry service). No self-hosted Docker Registry component is affected.
Mitigation: Docker has patched Docker Hub server-side. No user action is required to receive the fix. Affected users should rotate any PATs that were active during the exposure window and audit repository push/pull/delete history for unexpected activity.
