What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A Docker Hub identity and access-management flaw could leave a personal access token (PAT) valid after an account was converted into an organization, while Docker Hub reassigned the token’s owner record to the person named as the organization owner. Anyone retaining that secret could authenticate to the registry as the named owner and use the token’s existing permissions to pull, push or delete images.
Docker says it fixed the conversion flow in production on September 30, 2026. Its investigation found no evidence that the vulnerability was exploited, but Docker also says registry logs cannot show whether a transferred token was never used. It therefore treated every PAT transferred during the exposure period as potentially affected.
As an Amazon Associate I earn from qualifying purchases.
What the Docker Hub vulnerability did
Docker Hub lets a personal account become an organization so a repository namespace can move under organization ownership without breaking existing image pulls. Beginning August 26, 2024, the conversion process reassigned the converting account’s PAT records to the account selected as the new organization owner.
The implementation changed the ownership record without rotating or revoking the underlying secret. The person named as owner was not asked to confirm the change and was not notified at the time. If another party still possessed the old secret, that credential could then authenticate to Docker Hub’s registry as the named owner, within the token’s scope and the access available to that identity.
#1 Best Overall
What an attacker could do
- Pull private repositories available to the affected identity.
- Push new images or overwrite tags in repositories the token could modify.
- Delete images where the token’s registry permissions allowed deletion.
The researchers who disclosed the issue, Peter Molnar and Krisztian Hozak of mptrdev.com, say they reproduced it independently. Their proof of concept logged in as a target, pushed to the target’s namespace and an organization repository, and pulled private repositories available to the target. Docker’s advisory separately confirms the possible registry-level pull, push and delete permissions, limited by token scope and the user’s access.
What the flaw did not provide
This was not a compromise of Docker’s infrastructure. Docker says the vulnerability did not provide access to the Docker Hub web interface and could not change a target’s password, email address or two-factor-authentication settings. It did not take over the account through those controls.
The risk was instead unauthorized registry activity performed under a legitimate user or organization identity. A malicious image or altered tag could appear trustworthy to consumers because it was published through an account that normally had permission to publish there. Docker characterized that as a critical software supply-chain risk.
The researchers discussed a hypothetical worst-case scenario involving Docker Official Images, but marked it unconfirmed. There is no evidence in the published findings that this scenario occurred or was shown to be exploitable.
Exposure window and response timeline
| Date and time | Event |
|---|---|
| August 26, 2024, 20:33 UTC | Docker’s stated start of the exposure window. |
| September 28–29, 2026 | The researchers disclosed reproduction of the issue; they describe independent reproduction and impact testing on September 29. |
| September 30, 2026, 11:40 a.m. U.S. Eastern | Docker says it received the report. |
| September 30, 2026, approximately 3:10 p.m. U.S. Eastern (approximately 19:10 UTC) | Docker says it deployed and verified a production fix. |
| October 2, 2026 | Docker says it emailed potentially exposed users and associated organization owners. |
| October 8, 2026 | Docker says it deactivated transferred PATs, except tokens users had asked to keep before the deadline. |
| October 12, 2026 | Docker published its advisory and identified the issue as CVE-2026-105445. |
Docker defines the full exposure period as August 26, 2024, 20:33 UTC, through approximately September 30, 2026, 19:10 UTC. The detailed response times above are reported by Docker in U.S. Eastern time where stated.
What Docker found in its investigation
Docker says it enumerated account conversions since August 26, 2024 and correlated them with registry-authentication logs, usage data and IAM token records. It reviewed about 304,000 pushes made with transferred tokens.
Docker CISO Mark Lechner wrote in the October 12 advisory: “We found no evidence that the vulnerability was exploited.” Docker says the reviewed pushes landed in the converted organization’s or new owner’s own repositories rather than unrelated accounts. It also says static analysis of the highest-risk public images found no malware, cryptominers, command-and-control activity, credential harvesting, persistence or tampering, and found no evidence that Docker infrastructure or services were affected.
That conclusion is a vendor investigation finding, not proof that no token was ever misused. Docker says registry logs show token use, but cannot reveal a transferred token that was never used. For that reason, Docker treated every PAT transferred during the exposure window as potentially affected, whether or not its logs showed activity.
Best Value
Was your Docker Hub account affected?
Docker says it emailed potentially exposed users on October 2, including the relevant token descriptions and creation dates. According to Docker, users who did not receive that email were not exposed through this specific account-conversion flow. The notification is the clearest official indication of whether Docker identified your account in the affected set.
Check and revoke personal access tokens
- Sign in to Docker Hub and open your account settings.
- Open the section for personal access tokens.
- Compare token names, descriptions and creation dates with the details in Docker’s notification and with the automation you still operate.
- Revoke any token you do not recognize or no longer use.
A token name chosen by an attacker is not proof that the credential is legitimate, so do not rely on the label alone when deciding whether it should remain active.
Move organization automation to organization credentials
For automation that belongs to an organization rather than an individual, Docker recommends organization access tokens instead of a person’s PAT. This separates shared operational access from an employee’s personal identity and avoids making a personal credential the dependency for organization-owned workflows.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow Docker changed the conversion process
Docker says the immediate fix removed PAT transfer during account-to-organization conversion. It also says it is adding consent and notification before someone is named an organization owner, recording an auditable history of token-ownership changes, and reviewing other credential-ownership flows for the same pattern.
Those changes address the two conditions that made the flaw dangerous: the secret remained valid while its apparent owner changed, and the new owner was not informed or asked to approve the transfer.
Quick Recap
What to take away
- The defect was in PAT ownership handling during account conversion, not in Docker Hub’s underlying infrastructure.
- A retained token could act as the named owner at the registry, with pull, push and delete capability constrained by scope and access.
- Web-account controls such as passwords, email and two-factor settings were outside the vulnerability.
- Docker fixed the conversion behavior on September 30, 2026, notified potentially exposed users and deactivated transferred tokens, subject to its stated opt-out exception.
- Docker found no evidence of exploitation, while warning that unused transferred tokens cannot be identified from registry logs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
