Ethical Hacking News
Docker Hub, the registry where container images are published and downloaded, has recently fixed a critical two-year-old hub flaw that allowed one user to push images as another user. The flaw, which was discovered by researchers Peter Molnar and Krisztian Hozak, was found to be critical because it allowed one user to gain unrestricted access to images and repositories. Docker has advised users to take steps to mitigate the risk of this vulnerability, including reviewing tokens and using organization access tokens. By doing so, users can reduce their risk of falling victim to this type of vulnerability.
Docker recently fixed a critical two-year-old flaw in its hub registry that allowed a user to push images as another user. The flaw was discovered in the feature that converts a personal account into an organization, allowing an attacker to access the registry under multiple identities. The vulnerability was rated critical because it included publishing images under a legitimate name. Docker found no evidence that the vulnerability was exploited during the time it was open, but recommended users take steps to mitigate the risk. Users can reduce their risk by reviewing tokens, revoking unused tokens, and using organization access tokens.
Docker, a leading containerization platform, has recently fixed a critical two-year-old hub flaw that allowed one user to push images as another user. The flaw, which was identified by researchers Peter Molnar and Krisztian Hozak, was discovered in the Docker Hub registry, where container images are published and downloaded.
The Docker Hub registry is a centralized platform where users can publish and manage their container images. It is a crucial component of the Docker ecosystem, as it provides a standardized way for developers to share and reuse images. However, the registry's security features were found to be vulnerable to a critical flaw that allowed one user to gain unrestricted access to images and repositories.
According to Docker, the flaw was discovered in the feature that converts a personal account into an organization. This feature transfers the account's personal access tokens (PATs) to the user designated as the organization's owner. A PAT is used in place of a password in the registry, and the person who created each token can still use it.
The flaw was found to be critical because it allowed one user to gain access to the registry under multiple identities. This means that an attacker could create a token on an account they controlled, convert that account into an organization, and name another user as its owner. The token would then work at the registry as that user, allowing the attacker to push, pull, or delete images in the named owner's repositories and in organizations the owner could access.
Docker rated the flaw critical because it included publishing images under a legitimate name. The flaw was open from August 26, 2024, until the fix was deployed on September 30, 2026. During this time, Docker reviewed every account conversion made and compared them with registry logs and token records. However, the company found no evidence that the vulnerability was exploited.
The researchers who discovered the flaw, Peter Molnar and Krisztian Hozak, reported it to Docker, which deployed the fix less than four hours after receiving their report. The researchers also reproduced the flaw twice on consenting test accounts and published a technical write-up detailing their findings.
To mitigate the risk of this vulnerability, Docker advises users to review their tokens, revoke any they do not recognize or no longer use, and use organization access tokens, not one person's PAT, for automation that belongs to an organization. Docker also recommends checking the open account settings, then personal access tokens, to see when each token was created and when it was last used.
Furthermore, Docker's documentation described the token transfer for about 17 of the roughly 25 months the flaw was open. However, on April 22, 2025, a documentation change was made, adding a note to Docker's conversion page. The note stated that naming a user as organization owner "will ensure any PATs associated with the user's account are transferred to the organization owner." However, the note was removed on September 30, minutes after the time it gives for the fix.
In conclusion, the Docker Hub flaw highlights the importance of regular security audits and vulnerability testing. It also emphasizes the need for users to be aware of the security features of their containerization platforms and to take steps to mitigate potential risks. By reviewing tokens, revoking unused tokens, and using organization access tokens, users can reduce their risk of falling victim to this type of vulnerability.
Related Information:
https://www.ethicalhackingnews.com/articles/Docker-Hub-Flaw-Leaves-One-User-with-Unrestricted-Access-to-Images-and-Repositories-ehn.shtml
https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html
Published: Tue Oct 13 14:18:46 2026 by llama3.2 3B Q4_K_M
