CVE‑2026‑105445: Docker Hub Token Transfer Flaw Explained

Key facts from the advisory #

• Identifier: CVE-2026-105445, reported through Docker's Vulnerability Disclosure Program on September 30, 2026.
• Mechanism: During account-to-organization conversion, PATs were re-assigned to the named owner by changing the token's owner record, without rotating or revoking the token secret.
• Start of exposure window: August 26, 2024, 20:33 UTC.
• Fix: Deployed to production on September 30, 2026. Conversion no longer transfers PATs.
• Severity: Docker rated the issue critical and treated it as a software supply chain risk.
• Exploitation: Docker reports no evidence that the vulnerability was exploited.
• Notification: Exposed users and organization owners were emailed on October 2, 2026.
• Remediation: Transferred PATs were deactivated on October 8, 2026, except where the account holder opted out.

Why it matters #

The advisory frames this as a problem of credential ownership. A PAT authenticates to the registry, and the conversion flow changed the identity that a token acted as. It did this without rotating the secret and without asking the new owner to confirm. The advisory states that a re-assigned token acted as the target user at the registry level, within the token's scope.

Docker ties the critical rating to that scope. According to the advisory, an attacker could potentially pull, push, and delete images in the target's repositories and in organizations where the target had access. The advisory says that because this included publishing images under a legitimate name, Docker treated the issue as a software supply chain risk.

The advisory also sets out what the flaw could not do. It did not give access to the Docker Hub web interface. It could not be used to change the target's password, email address, or two-factor settings, and it could not take over the account.

How the flaw worked #

The advisory describes the sequence that the two design gaps made possible. The steps below follow the order Docker gives them.

1. An attacker creates an account and generates a PAT on it.
2. The attacker converts that account to an organization and names a target user as the owner.
3. The attacker's PAT is re-assigned to the target user.
4. The attacker still holds the token secret, and the PAT remains active with the target user's scope.

The advisory explains the background for this flow. Docker Hub has no way to move a repository from one account to another, so conversion is how a personal namespace becomes an organization-owned one without breaking Docker pulls that reference it. The advisory says that starting August 26, 2024, conversion also re-assigned the converted account's PATs to the new owner.

The advisory defines the exposure window as running from August 26, 2024, 20:33 UTC, until the fix was deployed on September 30, 2026. It gives the end of that window as approximately 19:10 UTC. In the published text, that value appears in square brackets.

What Docker investigated #

Docker says it enumerated every account conversion performed since August 26, 2024. It correlated those conversions with registry authentication logs, Docker Hub usage data, and IAM token records. The team looked for any token used under more than one identity, and it examined every push made with a transferred token. The advisory puts the number of those pushes at about 304,000.

Docker reports that it found no evidence the vulnerability was exploited. Every push made with a transferred token landed either in the converted organization's own repositories or in the new owner's own repositories. None went into an unrelated user's or organization's account. The advisory also says that in the large majority of cases, the converted account and the named owner belonged to the same person or team, which it describes as the normal, legitimate use of the feature.

For the highest-risk public images, Docker ran static analysis without executing them. These were images pushed after a conversion where the team could not establish that the same person controlled both accounts. The advisory reports no malware, cryptominers, command-and-control activity, credential harvesting, persistence, or tampering in those images. It also states that Docker found no evidence its own infrastructure or services were affected.

Timeline of response #

The advisory lists its timeline in U.S. Eastern time. The table reproduces each entry as the advisory gives it.

The advisory states that the fix was deployed less than four hours after the report was received. The 11:40 AM report time and the roughly 3:10 PM deployment time in the table are consistent with that statement.

Who is affected #

The advisory describes the exposed population as limited. On October 2, Docker emailed the users whose accounts received transferred PATs, using the subject line "Docker Hub Vulnerability Identified & Resolved." Each email listed the in-scope tokens by description and creation date. Docker separately notified the associated organization owners.

Organization members are covered by the same test. The advisory states that if you did not receive the email, you and any members of the organizations you administer were not exposed. For that reason, the email is the advisory's marker of exposure for each account.

Changes and recommended actions #

The advisory states that the immediate fix removed PAT transfer from conversion entirely. It lists further changes that Docker is making:

• Requiring consent from a user before that user is named as an organization owner, and notifying the user when this happens.
• Recording an auditable history of every token ownership change, so that questions like this can be answered from records.
• Reviewing other flows that change credential ownership for the same pattern.

On October 8, Docker deactivated the identified transferred PATs. Tokens that their owners asked to keep before the deadline were excluded, and the advisory notes that the deactivation applied except where the account holder opted out.

The advisory gives two recommendations for users. The first is to review the personal access tokens on your account under Account settings, then Personal access tokens, and revoke any you do not recognize or no longer use. The second is to use organization access tokens for automation that belongs to an organization, rather than a person's PAT. Questions about the notice can go to Docker Support at app.docker.com/support/contact. Security issues in Docker products can be reported to security@docker.com.

The advisory credits Peter Molnar and Krisztian Hozak of mptrdev.com for finding the issue and reporting it responsibly. It refers readers to their technical write-up at ghostpat.com. The advisory closes by describing responsible disclosure as a partnership between researchers and vendors.