Docker disclosed a critical vulnerability in Docker Hub that let an attacker reassign a personal access token (PAT) to a designated organisation owner without changing the secret or obtaining consent, thereby authenticating as the target user at registry level. Exploited by creating an account and PAT, converting the account into an organisation, and naming the victim as its owner, the flaw enabled the attacker to pull, push or delete images in the target's repositories and organisations they could access — a software supply-chain risk because images could be pushed under a legitimate name. Docker rated it critical, confirmed that the transferred PATs were deactivated on 8 October (except where owners opted to retain them) and reported no evidence of exploitation after reviewing 304,000 affected pushes. The registry no longer transfers PATs during conversion and now requests user consent before naming anyone an organisation owner. Organisations should rotate any Docker PATs tied to account-to-organisation conversions and audit image-tamper exposure.

• Source article