Docker fixed a critical security vulnerability in Docker Hub that allowed personal access tokens (PATs) to be reassigned to a new owner when a personal account was converted into an organization, without rotating or revoking the token or obtaining the new owner’s consent. The vulnerability is tracked as CVE-2026-105445, and the company considered it a software supply chain risk.
Researchers Peter Molnar and Krisztian Hozak reported the issue on September 30, 2026, through the vulnerability disclosure program, and Docker confirmed that it deployed the fix less than four hours later, at around 19:10 UTC. The potential exposure period extended from August 26, 2024, at 20:33 UTC, until the fix was deployed.
How could the flaw be exploited?
Docker Hub allows a personal account to be converted into an organization while preserving the same repository path, such as converting alice/app into a repository owned by an organization without breaking existing pull operations. During the conversion process, the user selected an existing account to become the owner of the new organization.
Since the flawed behavior was introduced, PATs belonging to the converted account were transferred to the account designated as the owner, while the token secret remained with its creator. The new owner was neither required to confirm the operation nor notified of it. As a result, an attacker could use the token as though it belonged to the targeted owner at the Docker registry level.
Depending on the token’s scope, this could have allowed images to be pulled, pushed, or deleted from the victim’s repositories or from organizations to which the victim had access. The Docker Hub interface itself was not accessible through the flaw, and it was not possible to change the password, email address, two-factor authentication settings, or take over the account.
Investigation results and containment measures
Docker reviewed all account conversions since August 26, 2024, correlating them with authentication logs, Docker Hub usage, and identity and token management logs. It also examined approximately 304,000 push operations performed using transferred tokens and said it found no evidence that the vulnerability had been exploited.
All push operations reviewed by the company took place within the converted organization’s repositories or the new owner’s repositories, and no operations were recorded in unrelated accounts or organizations. The company also statically analyzed the highest-risk public images and found no malware, mining tools, command-and-control activity, credential theft, persistence mechanisms, or image tampering.
However, Docker explained that registry logs show token usage and do not prove that a token exists if it was not used. Therefore, it treated every PAT transferred through a conversion operation during the exposure period as affected, regardless of whether its use appeared in the logs.
What changed in practice?
Docker permanently stopped transferring PATs during account conversions and, on October 2, sent notifications to affected users and the relevant organization owners. On October 8, it disabled the transferred tokens it identified, except for tokens whose owners had requested that they remain active before the deadline.
The company now also requires a user’s consent before designating them as an organization owner and notifies them when this occurs. It will record an auditable history for every change in token ownership. Docker is currently reviewing other workflows that may change credential ownership for the same pattern.
The company recommends reviewing personal access tokens in the Docker Hub account settings and revoking any unknown or no-longer-used token. For organization automation, it recommends using organization access tokens instead of a personal token linked to an individual.