# Docker discloses token-transfer flaw that enabled publishing as other users

_Published Tuesday, October 13, 2026 at 3:39 PM EDT · Security · Latest · Tier 2 — Notable_

![Docker discloses token-transfer flaw that enabled publishing as other users — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEile879Rmv8zAdU5PMclUp5RnNGDb3h1u3aVZ-VigGjnO0RFcyCQ03s7_lIqMGDiow5ilPumq3B2_bsvewqRlepch4lFwLvOUEDQZPYd9Vv8untJVZFmrv5Zhgvj54cs4J_vCYW4GVY-XsQl7SXD-yrXbED6KpiWbTq-kL_0aNwef3xjV3cBGQ3dsodqAM/s1700-nu-rw-lo-l85-e365/dock.jpg)

Docker disclosed on October 12 that a critical Docker Hub flaw let users push, pull or delete container images as another user. The flaw was fixed September 30; Docker says it found no evidence of exploitation after reviewing account conversions and approximately 304,000 pushes made with transferred tokens.

Converting a personal account into an organization reassigned its access tokens to the named owner without changing their secrets. A token's creator could consequently retain registry access under that owner's identity. Docker now requires owner consent and sends notifications. The flaw did not permit account takeover, and Docker's published review results cover pushes rather than findings for pulls or deletions.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html)

---
Canonical: https://techandbusiness.org/newswire/NZArEz3KK5Jfcq9CqdWDHN
Published: 2026-10-13T19:39:22.881Z
Story chronology: 2026-10-12T00:00:00.000Z
Retrieved: 2026-10-13T21:53:09.197Z
Publisher: Tech & Business (techandbusiness.org)