CVE-2026-105445

CVE Enrichment

CVSS: 9.4 CRITICAL
EPSS: 0.43%
EPSS Percentile: 37.17%
CISA KEV: Not listed

Description

An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 14-Oct-2026 01:17
Last Modified: 19-Oct-2026 20:16
EPSS Date: 2026-10-28
CWE: CWE-266

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:L /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

Docker · Docker Hub Source: CNA · [email protected]
Default status: unaffected

2024-08-26T20:33:00Z ≤ version < 2026-09-30T19:10:00Z — affected (date)

References

Last enrichment sync: 05-Nov-2026 17:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

CVE-2026-105445: Docker Hub PAT Reassignment Flaw Docker Hub Flaw Let Reassigned Personal Access Tokens Retain Their Secrets
Docker tracks the flaw as CVE-2026-105445 and rated it critical. The CVE record it published on October 13 gives the flaw a CVSS 4.0 score of 9.4. Docker Fixes Critical Hub Flaw That Let Users Push Images as Others
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user’s container repositories using a personal access token (PAT). Docker Hub Flaw Let Attackers Impersonate Users and Tamper With Container Images

People (3)

Vendors (1)

Products (1)

Tools (1)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.