Who acted versus who is named: two platform fixes on the same day close the same gap

Victoria Shinder13 October 2026, 06:542 min read

Two announcements from the past few days — Docker's advisory for CVE-2026-105445 and GitHub's push attribution preview — look unrelated. One is a vulnerability, the other a feature. Both, however, deal with the same gap: a record that names one identity while a different one did the work.

Docker Hub: the record moved, the secret did not. When a Docker Hub account was converted into an organization, its personal access tokens were re-assigned to the named owner by changing the owner record. The secret was not rotated. Whoever created the token kept it, and from then on it authenticated as somebody else. Docker found no exploitation across about 304,000 pushes, but it also said plainly that logs show when a token is used, not that it exists — which is why it treated every transferred token as affected and deactivated them on 8 October.

GitHub: the record never held the actor. Commit author and committer are strings the client writes; GitHub's own changelog says anyone with write access can set them to anything. Until now, the identity GitHub actually authenticated on push was not stored with each commit. Push attribution adds it, and a new ruleset condition rejects pushes whose committer email is not one of the pusher's verified addresses.

The common lesson. In both cases an audit that reads the visible record — the token's owner, the commit's committer — reads a claim. The authenticated actor is a separate fact, and until now it was either kept somewhere else (registry authentication logs, push logs) or not kept at all.

What to do with that, practically.

• Prefer credentials that belong to the organization. Docker's own advice is organization access tokens for automation instead of a person's PAT; the same reasoning applies to any registry or forge where a personal token outlives a change of role.
• Treat ownership changes as credential events. A transfer, conversion or role change that keeps a secret alive is the moment to rotate it. Docker is adding consent and an auditable history of token ownership changes for this reason.
• Store the actor next to the artefact. Where a platform offers an authenticated "who did this" field — GitHub's pusher identity is the newest example — turn it on and put it in audit queries, because reconstructing it later from logs depends on logs that may not exist.

Neither change fixes the other's problem. Together they mark the direction: supply-chain trust is moving from what a record says to who was authenticated when it was written.

Sources: Docker, advisory for CVE-2026-105445 — https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445 ; GitHub Changelog, push attribution — https://github.blog/changelog/2026-10-12-push-attribution-public-preview