Docker Hub Fixes Critical Security Flaw in Account Conversions

Docker has issued a security advisory detailing a vulnerability tracked as CVE-2026-105445, which inadvertently transferred personal access tokens (PATs) during account-to-organization conversions. The flaw affected Docker Hub users who converted personal accounts into organizations between August 26, 2024, and September 30, 2026.

Security researchers Peter Molnar and Krisztian Hozak reported the issue through Docker’s Vulnerability Disclosure Program on September 30, 2026. Production fixes were deployed later that same afternoon, less than four hours after the initial report.

What Changed and Practical Consequences

When users convert a Docker Hub personal account into an organization, the platform re-assigns the ownership record. Due to the vulnerability, this process automatically reassigned any personal access tokens belonging to the converted account over to the newly named organization owner without rotating secrets, requesting confirmation, or sending notifications.

This oversight allowed an attacker to create an account, generate a PAT, and convert that account into an organization while assigning a target user as the owner. The attacker retained the active token secret, granting them registry-level capabilities matching the target user’s scope. While attackers could theoretically push, pull, or delete images within the scope, the flaw did not provide access to the Docker Hub web interface, reset passwords, or alter two-factor settings.

Investigation Findings and Scope

Docker reviewed account conversions and registry logs dating back to August 2024, analyzing approximately 304,000 pushes made with transferred tokens. Investigators found no evidence of active exploitation or malicious payloads in public images tied to the vulnerability. However, because registry logs track token usage rather than existence, Docker treated all tokens moved during the exposure window as potentially affected.

Availability and Mitigation Steps

Docker notified exposed users and organization owners via email on October 2, 2026. On October 8, the platform forced the deactivation of all PATs that had been transferred through the conversion process, unless owners had explicitly opted out prior to the deadline.

Account conversions no longer transfer PATs automatically. Moving forward, Docker requires user consent and notifications for organization ownership changes, along with an auditable history of token ownership modifications. Users are advised to review their active personal access tokens in Docker Hub account settings and transition automation workflows to organization access tokens.

Source

Official announcement or documentation