Docker disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). Docker Hub is an online registry for storing, sharing, and downloading container images, which are templates that package everything needed for an application to run in an isolated environment. In Docker Hub, a PAT serves as a secret used to authenticate tools and workflows, allowing users to pull, push, or delete container images.
According to a security bulletin from the Docker team, an attacker could create an account and PAT, then convert the account into an organization and name a target user as its owner. The flaw stemmed from Docker Hub reassigning a PAT to a designated organization owner without changing its secret or obtaining the target's consent. This allowed the attacker to use the token to authenticate as the target. Depending on the token's scope and the target's permissions, attackers could pull, push, or delete images in the target's repositories and accessible organizations.
"Within the scope of the token, a re-assigned PAT acted as the target user at the registry level, meaning an attacker could potentially pull, push, and/or delete images in the target's repositories and in organizations where the target had access," Docker explained. "Because that includes publishing images under a legitimate name, we treated this as a software supply chain risk and rated it critical."
The vulnerability was introduced on August 26, 2024, when the conversion process started reassigning the personal account PAT to the new owner without revoking or rotating the secret and without asking the named owner to confirm the change. Docker said the flaw did not provide Docker Hub web access or allow attackers to change passwords, email addresses, or two-factor settings.
On September 30, 2026, Docker received a vulnerability report describing the issue, confirmed it, and deployed a fix to production less than four hours later. Docker examined 304,000 pushes made with transferred tokens and analyzed high-risk public images, finding no evidence of exploitation. Affected users and organization owners were notified on October 2, and transferred PATs were deactivated on October 8, except for those whose owners explicitly requested to retain them. Docker says users who did not receive a notification should assume they were not impacted. The platform no longer transfers PATs during conversion and now requests user consent before naming them an organization owner.