Docker discloses token-transfer flaw that enabled publishing as other users

Docker disclosed on October 12 that a critical Docker Hub flaw let users push, pull or delete container images as another user. The flaw was fixed September 30; Docker says it found no evidence of exploitation after reviewing account conversions and approximately 304,000 pushes made with transferred tokens. Converting a personal account into an organization reassigned its access tokens to the named owner without changing their secrets. A token's creator could consequently retain registry access under that owner's identity. Docker now requires owner consent and sends notifications. The flaw did not permit account takeover, and Docker's published review results cover pushes rather than findings for pulls or deletions.