Docker Hub fixes critical flaw that passed access tokens to new owners

Docker Hub fixes critical flaw that passed access tokens to new owners

12 October 2026: Docker has disclosed CVE-2026-105445, a flaw it rates critical in the way Docker Hub converts a personal account into an organisation. The conversion handed the old account's personal access tokens (PATs) to the user named as the new owner without changing the secrets, so whoever created a token could keep using it as that owner. Docker fixed the service on 30 September 2026 and says it found no evidence of exploitation.

Not yet independently verified. Single source: Docker's own advisory. The no-exploitation finding and the 304,000-push figure are Docker's and have not been independently checked. We will update this when it can be confirmed, and remove this note.

How a token could be planted on someone else

Docker Hub lets a user turn an account into an organisation so that repository names such as alice/app keep working and pulls do not break. During the conversion the user names an existing Docker Hub account as the owner of the new organisation.

The conversion re-assigned every PAT on the converted account to that named owner. It changed the owner record on the token but did not rotate or revoke the secret, and the new owner was neither asked to confirm nor told. An attacker could therefore create an account, generate a token on it, convert the account to an organisation naming a target as owner, and keep the secret. The token then authenticated to the registry as the target, with the scope the attacker had given it.

Docker's advisory says the flaw was introduced on 26 August 2024, so the exposure window ran for just over two years.

What the tokens could and could not do

Inside the token's scope, an attacker could pull, push and delete images in the target's repositories and in any organisation the target could reach. Docker names publishing images under a legitimate name as the main supply chain worry. A token could not open the Docker Hub web interface, change the target's password, email address or two-factor settings, or take over the account.

How quickly Docker acted

Docker received the report at security@docker.com on 30 September 2026 and reproduced it with internal test accounts about two hours later. The fix reached production at about 15:10 US Eastern time the same day, less than four hours after the report, and was verified against the researchers' proof of concept. Documentation was updated to say that PATs do not transfer and must be recreated by the new owner, and Docker now recommends organisation access tokens for team automation.

The researchers, Peter Molnar and Krisztian Hozak of mptrdev.com, found and reported the issue and agreed a coordinated disclosure with Docker.

What the audit of 304,000 pushes found

Docker listed every conversion since 26 August 2024 and matched it against registry authentication logs, usage data and token records. It looked for tokens used under more than one identity and reviewed about 304,000 pushes made with transferred tokens. Every push landed in the converted organisation's own repositories or the new owner's own repositories, and in most cases the converted account and the named owner were the same person or team.

For the highest-risk public images, those pushed after a conversion where common control could not be established, Docker ran static analysis without executing them and reports no malware, cryptominers, command-and-control activity, credential harvesting, persistence or tampering. Docker's own infrastructure was not affected.

The audit has a stated limit. Registry logs show a token being used but not a token merely existing, so an unused transferred token leaves no trace. Docker therefore treated every PAT that moved through a conversion in the window as potentially exposed.

Tokens deactivated and what Docker changed

Docker emailed affected users and organisation owners on 2 October 2026 under the subject "Docker Hub Vulnerability Identified & Resolved". On 8 October it deactivated all identified transferred PATs, except those owners had asked to keep before the deadline. Anyone who did not receive the email had no PAT transferred and needs to take no action, according to the advisory.

PAT transfer has been removed from conversion altogether. A user must now consent before being named as an organisation owner and is notified when it happens, every change of token ownership is written to an auditable history, and Docker is reviewing other flows that change credential ownership.

Teams that did get the email should check the tokens listed by description and creation date under Docker Hub account settings, and confirm that no CI job depends on one that was switched off on 8 October. Docker also advises reviewing every PAT and revoking any nobody recognises, even without the email.

Related on TrustList:

• HPE iMC authentication bypass (CVSS 9.1) is fixed in 7.3 E0713
• AWS CDK fixes a symlink flaw in Docker asset bundling in 2.267.0
• Docker Engine 29.8.2 fixes DNS trick that disables TLS checks

Sources

• Docker: Docker Hub security advisory, personal access tokens transferred during account-to-organization conversions, 12 October 2026