GhostPat CVE‑2026‑105445: Docker Hub Tokens Moved on Org Conversion

• The flaw: account-to-organization conversion re-assigned the converted account's personal access tokens (PATs) to the named owner by changing the owner record, without rotating or revoking the secret, and without asking or notifying that owner. The CVE record classes it as incorrect privilege assignment, CWE-266.
• What a moved token could do: within its scopes, pull, push or delete images in the victim's repositories and in organizations the victim could access. It gave no access to the Docker Hub web interface and could not change the victim's password, email or two-factor settings.
• Exposure window: August 26, 2024, 20:33 UTC to September 30, 2026, 19:10 UTC, the boundaries the CVE record gives.
• Who was exposed: only users who received Docker's email of October 2 with the subject "Docker Hub Vulnerability Identified & Resolved", and the owners of their organizations. Docker says users without that email were not exposed.
• Credit: Peter Molnar and Krisztian Hozak of mptrdev.com reported it through Docker's vulnerability disclosure program; their technical write-up is at ghostpat.com.

Why Docker Rated a Token Ownership Bug Critical #

A token that acts as another user at the registry can publish images under that user's legitimate repository names, so the Docker advisory by CISO Mark Lechner treats the bug as a software supply chain risk. The attack needed no access to the victim's account at all: the attacker only had to create an account, generate a token, convert the account and type the victim's username as owner. Docker reviewed every conversion since August 26, 2024 and about 304,000 pushes made with transferred tokens, and found each one in the converted organization's or the new owner's own repositories. It also statically analyzed the riskiest public images and found no malware or tampering.

Docker is explicit about the limit of that review: registry logs show when a token is used, not that it exists, so a transferred token that was never used leaves no trace. For that reason it treated every token that moved through a conversion as potentially affected. On October 8 it deactivated those tokens, except where their holders had asked to keep them before the deadline. CISA's SSVC assessment of October 19 rates exploitation as none.

What Docker Hub Users and Organization Owners Should Check #

Users who got the October 2 email should open the token list it gave, which named each in-scope token by description and creation date, and confirm those tokens are gone. A token's description is set by whoever created it, so a familiar-looking name on an unexpected token proves nothing about where it came from. Docker's general advice applies to everyone: review the tokens under Account settings, Personal access tokens, and revoke any that are unknown or unused, and use organization access tokens rather than a person's PAT for organization automation.

Conversion no longer moves tokens at all, and Docker's documentation now says that the new owner must create their own. Docker also says it will require consent before a user is named as an organization owner, notify the user when it happens, record an auditable history of token ownership changes, and review other flows that change credential ownership.

A Fix in Under Four Hours, Disclosure Twelve Days Later #

The report reached Docker at 11:40 AM Eastern on September 30, the fix was in production at about 3:10 PM the same day, and the documentation was updated about 13 minutes later. Docker notified affected users on October 2, deactivated transferred tokens on October 8, published the advisory on October 12, and the CVE record followed on October 13.