Docker Hub bug let strangers hijack access tokens and push tainted images
A critical flaw tracked as CVE-2026-105445 quietly reassigned personal access tokens during account conversions for two years before Docker patched it.
Key points
- A Docker Hub flaw introduced on August 26, 2024 silently handed one user's access token to another whenever an account was converted into an organization, leaving the weakness in production for over two years before any fix landed.
- The bug is tracked as CVE-2026-105445 and carries a critical CVSS rating.
- Docker examined 304,000 image pushes made with transferred tokens and found no evidence of abuse.
- Docker received the report on September 30, 2026 and shipped a production fix in under four hours.
- Affected account holders were notified on October 2, 2026, and the transferred tokens were switched off on October 8 unless the new owner asked to keep them.
Docker has patched a critical weakness in Docker Hub, the world's largest public registry of container images, that let one user quietly inherit another user's authentication token and act as them inside the registry.
Container images are prepackaged bundles of software that developers download and run inside isolated environments. Docker Hub stores millions of them, and many large organizations pull from it every day.
A personal access token, or PAT, is a long secret string that stands in for a password when scripts and build tools talk to the registry. Lose control of one and an attacker can pull private code or push and delete existing images.
How did the flaw work?
The bug lived in Docker Hub's account-conversion feature. During conversion of a personal account into an organization, Docker Hub reassigned the original account's PAT to whoever was named as the new organization owner, without changing the secret and without asking that person to confirm.
The recipe for abuse was short. Create an account, generate a token, convert the account to an organization, name your intended victim as the owner. Your token then authenticated as them.
"Within the scope of the token, a re-assigned PAT acted as the target user at the registry level," Docker wrote in its advisory, "meaning an attacker could potentially pull, push, and/or delete images in the target's repositories and in organizations where the target had access."
That's why Docker treated this as a software supply chain problem. An attacker could publish a poisoned image under a legitimate maintainer's name, and anyone pulling from that namespace would trust it. We covered the supply chain implications of container provenance in our 17 September piece on Chainguard's build manifest milestone.
What the flaw did not allow
The stolen access stopped at the registry. A hijacked token couldn't log the attacker into the Docker Hub website, and it couldn't touch the victim's password, two-factor settings, or email address. Legitimate owners weren't locked out.
That's a meaningful limit. Defenders had a chance to spot odd pushes in their own repositories, and the blast radius was narrower than a full account takeover.
Timeline and scope
| Date | Event |
|---|---|
| Aug 26, 2024 | Flawed conversion behaviour introduced |
| Sep 30, 2026 | Docker receives vulnerability report, fixes within four hours |
| Oct 2, 2026 | Affected users and organization owners notified |
| Oct 8, 2026 | Transferred tokens deactivated by default |
| Oct 13, 2026 | CVE-2026-105445 published |
Docker says it examined 304,000 pushes made using transferred tokens and reviewed high-risk public images for signs of tampering. It reports finding none. First reported by BleepingComputer, the disclosure also notes that users who were not emailed can assume they were not affected.
My read: the capability here was serious and the intent, as far as anyone can tell, never showed up. A silent token reassignment sitting in production for just over two years is the kind of logic bug that static scanners never catch. It's worth asking how many other registries have conversion flows that quietly carry secrets across trust boundaries. Watch for similar reports from competing registries in the coming months.
What should Docker Hub users do?
If you didn't get an email from Docker, you weren't affected. The transferred token has already been deactivated for those who did receive notice, unless they asked to keep it. Rotate any token you're unsure about and review your repositories' push history for images you didn't publish yourself.
Docker has changed the conversion flow so tokens no longer travel with the account, and the named organization owner now has to consent before the handover completes.
