Docker Hub Patch Closes Two-Year Vulnerability That Allowed Cross‑User Image Manipulation

Docker announced on September 30 that it had patched a critical security flaw in Docker Hub that existed for roughly two years and could have let a malicious account act on behalf of another, including pushing, pulling or deleting container images.

The vulnerability stemmed from a misconfiguration in Docker Hub's repository‑access logic, which failed to correctly enforce ownership checks when a user performed actions on images. In practice, an attacker who discovered the issue could have overwritten or removed images belonging to a different developer, potentially disrupting software supply chains that rely on Docker's public registry.

Docker said its internal investigation found no signs that the defect was exploited in the wild. The company has not reported any incidents of unauthorized image changes or deletions linked to the flaw, and it is urging users to review recent activity on their repositories as a precaution.

Docker Hub is the most widely used registry for container images, serving millions of developers and enterprises that publish, share, and retrieve software packages built on Docker. Because containers are a fundamental component of modern cloud‑native deployments, any compromise of the registry can have cascading effects on downstream applications and services.

Security researchers who first reported the issue highlighted the broader risk that such a weakness poses to the software supply chain. If an attacker were able to replace a popular image with a malicious version, downstream users who automatically pull the latest tag could inadvertently introduce vulnerabilities into their production environments.

Following the fix, Docker is recommending that all account holders rotate any credentials that may have been used to access Docker Hub, enable two‑factor authentication, and audit logs for unexpected activity. The company also pledged to improve its internal testing procedures to detect similar access‑control errors before they reach production.

While Docker's prompt response and lack of known abuse are reassuring, the episode underscores the importance of continuous security monitoring for critical infrastructure components. Industry observers expect that the incident will prompt other container registry providers to re‑examine their own access controls and may accelerate adoption of signed image workflows and provenance tools that can further safeguard the software supply chain.