What’s Vulnerable › Vulnerabilities

CVE-2026-105445: Docker Hub account conversion could reassign an active personal access token to another user

• Severity: critical (CVSS 9.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-19
• Weakness: CWE-266

Description

An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.

Affected products

• Docker Hub: from 2024-08-26T20:33:00Z before 2026-09-30T19:10:00Z — fixed in 2026-09-30T19:10:00Z

How to fix

Upgrade to a fixed version: Docker Hub 2026-09-30T19:10:00Z. Check the vendor advisory for mitigations.

References

• https://docs.docker.com/accounts/organization/setup/convert-account/
• https://ghostpat.com/
• https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/

Get alerted when CVE-2026-105445 or the next vulnerability affects your stack