Docker Hub Flaw Let Reassigned Personal Access Tokens Retain Their Secrets
Summary
Docker fixed a Docker Hub flaw that let original PAT creators retain registry access after tokens were reassigned during account conversion. Docker found no evidence of exploitation and deactivated identified affected tokens.
Key points
- CVE-2026-105445 (CVSS 4.0: 9.4) affected Docker Hub’s account-to-organization conversion process, not Docker Engine or Desktop.
- From August 26, 2024, until the server-side fix on September 30, 2026, conversion reassigned PAT ownership without rotating or revoking the token secret.
- An original token creator could potentially use the token with the recipient’s registry permissions to pull, push, or delete images, creating supply-chain risk.
- Docker reported no evidence of exploitation after reviewing conversions and registry activity; researchers reproduced the flaw with test accounts.
- Docker force-deactivated identified transferred PATs on October 8, except those owners chose to retain. New organization owners must create appropriate credentials.
- Affected organizations should review Docker’s notification, inventory and revoke obsolete or unfamiliar tokens, rotate relevant CI/CD credentials, and check registry and pipeline activity.
- Validate image digests, signatures, SBOMs, and provenance; unused transferred tokens may not appear in registry-use logs.
Article Details
- Vulnerability Types
- Incorrect privilege assignment during Docker Hub personal-account-to-organization conversion
- Severity
- Critical; CVSS 4.0 score 9.4
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Inventory PATs and revoke obsolete or unfamiliar tokens.
- Rotate credentials used by CI/CD pipelines where appropriate.
- Prefer organization access tokens for organization-owned automation rather than individual PATs.