Docker Hub flaw could let attackers impersonate users and publish images

Docker reproduced the token flaw and deployed a fix in less than four hours

Docker said researchers Peter Molnar and Krisztian Hozak of mptrdev.com reported the issue through its vulnerability disclosure program. The company reproduced it with internal test accounts and deployed a fix less than four hours after receiving the report.

Under the affected process, a personal access token could move during an account conversion. Docker said the token’s permissions and the target user’s access determined whether images could be pulled, pushed or deleted.

Docker removed token transfer from account conversion

Docker said its immediate fix removed personal access token transfer from conversion entirely. It also began requiring a user’s consent before naming that user as an organization owner, notifying the user when that happened and recording an auditable history of every token ownership change.

The exposure window ran from Aug 26, 2024, to Sep 30, 2026

Docker said the exposure window began on Aug 26, 2024, at 20:33 UTC and ended on Sep 30, 2026, at approximately 19:10 UTC. The company said it deactivated identified transferred tokens on Oct 8, with an exception for tokens whose owners had asked to keep them.

Docker said it examined every push made with a transferred token, about 304,000 in all. Every examined push landed in repositories belonging to the converted organization or the new owner.

Docker said it deactivated the transferred tokens it identified on Oct 8, except for tokens whose owners had asked to retain them. It said it notified every user and organization owner whose account could have been impacted on Oct 2.

Todd Matens said he verified all 42 compose-lint images and traced each one to the CI run that built it. He said he rotated the tokens and separated them so each job received only the access it needed.