Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user’s container repositories using a personal access token (PAT).
Docker Hub is an online registry for storing, sharing, and downloading container images – templates that package everything needed for an application to run in an isolated environment.
In Docker Hub, a PAT serves as a secret used to authenticate tools and workflows. It allows you to pull, push, or delete container images.
According to a security bulletin from the Docker team, an attacker could create an account and PAT, then convert the account into an organization and name a target user as its owner.
The CVE-2026-105445 flaw stems from Docker Hub reassigning a personal access token (PAT) to a designated organization owner without changing its secret or obtaining the target’s consent. This allowed the attacker to use the token to authenticate as the target.
Depending on the token’s scope and the target’s permissions, attackers could pull, push, or delete images in the target’s repositories and accessible organizations.
“Within the scope of the token, a re-assigned PAT acted as the target user at the registry level, meaning an attacker could potentially pull, push, and/or delete images in the target’s repositories and in organizations where the target had access,” Docker explained.
“Because that includes publishing images under a legitimate name, we treated this as a software supply chain risk and rated it critical.”
Although the flaw is critical, Docker noted that it did not provide Docker Hub web access or allow attackers to change passwords, email addresses, or two-factor settings, potentially locking legitimate account holders out.
The vulnerability was introduced on August 26, 2024, when the conversion started reassigning the personal account PAT to the new owner. This occurred without revoking or rotating the secret, and without asking the named owner to confirm the change.
On September 30, 2026, Docker received a vulnerability report describing the issue, confirmed it, and deployed a fix to production less than four hours later.
Docker says it found no evidence of exploitation after examining 304,000 pushes made with transferred tokens and analyzing high-risk public images.
Affected users and organization owners were notified on October 2, and transferred PATs were deactivated on October 8, except for those whose owners explicitly requested to retain them.
Docker says users who didn’t receive a notification should assume they were not impacted and did not need to take any action.
The platform no longer transfers PATs during conversion and requests user consent before naming them an organization owner.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
