Docker Hub Fixes Two-Year Flaw Allowing Cross-Account Image Manipulation

Thu, 15 Oct 2026 15:35:13 +0000

Engineer — Plan: No client-side patch needed — Docker fixed this server-side — but teams should audit Docker Hub image push history over the past two years to verify no unauthorized image modifications occurred in repositories they own or depend on.
SOC/IR — Learn: No active exploitation, no IOCs, and no published PoC; the risk class — unauthorized registry writes enabling supply-chain poisoning — is worth factoring into future container image integrity detections, but there is no hunt to run today.
Leader — Learn: Docker’s own advisory states no confirmed exploitation in two years, so no immediate vendor-breach response is needed; file this as evidence of supply-chain risk exposure through shared registries for future vendor risk reviews of Docker Hub dependency.

Docker Hub flaw allowed user impersonation and image tampering via PAT

Tue, 13 Oct 2026 18:14:34 +0000

Engineer — Plan: Docker Hub patched this server-side, but any org using Docker Hub PATs should audit token activity for unauthorized access and verify image digests for unexpected modifications, particularly for images pulled before the patch window.
SOC/IR — Plan: No IOCs or active exploitation reported, but review Docker Hub audit logs for anomalous PAT usage; build or tune detections for unauthorized container registry access as this TTP (token-based impersonation enabling image tampering) could resurface.
Leader — Plan: This is a supply-chain risk event — confirm Docker has fully remediated the server-side flaw, review your organization’s PAT governance policy for Docker Hub, and flag this class of risk (registry impersonation enabling tampered images) as a standing vendor-risk consideration.
Signals: CVE-2026-105445 — CISA KEV: not listed, EPSS n/a, no public PoC found