Docker-Hub · CuraSec

tag: Docker-Hub · 2 items

Engineer — Plan: No client-side patch needed — Docker fixed this server-side — but teams should audit Docker Hub image push history over the past two years to verify no unauthorized image modifications occurred in repositories they own or depend on.
SOC/IR — Learn: No active exploitation, no IOCs, and no published PoC; the risk class — unauthorized registry writes enabling supply-chain poisoning — is worth factoring into future container image integrity detections, but there is no hunt to run today.
Leader — Learn: Docker’s own advisory states no confirmed exploitation in two years, so no immediate vendor-breach response is needed; file this as evidence of supply-chain risk exposure through shared registries for future vendor risk reviews of Docker Hub dependency.

Engineer — Plan: Docker Hub patched this server-side, but any org using Docker Hub PATs should audit token activity for unauthorized access and verify image digests for unexpected modifications, particularly for images pulled before the patch window.
SOC/IR — Plan: No IOCs or active exploitation reported, but review Docker Hub audit logs for anomalous PAT usage; build or tune detections for unauthorized container registry access as this TTP (token-based impersonation enabling image tampering) could resurface.
Leader — Plan: This is a supply-chain risk event — confirm Docker has fully remediated the server-side flaw, review your organization’s PAT governance policy for Docker Hub, and flag this class of risk (registry impersonation enabling tampered images) as a standing vendor-risk consideration.
Signals: CVE-2026-105445 — CISA KEV: not listed, EPSS n/a, no public PoC found