Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A Docker Hub flaw let a converted account’s personal access token (PAT) authenticate to the registry as the person named to own the new organization. Docker says the bug was fixed on September 30, 2026. It found no evidence of exploitation in its review, but says its logs cannot show whether a transferred token that was never used still exists. Potentially exposed users should check Docker’s notification and review their PATs.
What happened in the Docker Hub flaw?
When a Docker Hub personal account becomes an organization, its repository namespace can become organization-owned without breaking existing image pulls. Docker says a flaw in that conversion flow reassigned the converting account’s PAT ownership records to the account named as the new organization owner, without rotating or revoking the token secret. The named owner was neither asked to consent nor notified. The change began on August 26, 2024, at 20:33 UTC, according to Docker’s October 12, 2026 advisory.
Anyone who retained the secret could use it to authenticate to Docker Hub’s registry as the named owner. What the credential could do depended on its scope and the access associated with that identity; Docker says registry actions could include pulling, pushing, or deleting images within those permissions. This was an identity and access management flaw in the account-conversion flow, not a compromise of Docker’s infrastructure.
What researchers demonstrated
Researchers Peter Molnar and Krisztian Hozak of mptrdev.com said they independently reproduced the issue. In their proof of concept, they used a token to log in as a target, pushed to the target’s namespace and an organization repository, and pulled private repositories available to that target. Their description appears in the September 30, 2026 GhostPat disclosure. These demonstrations show what their test achieved; they are distinct from Docker’s later review of its production records.
#1 Best Overall
What could an attacker do—and what was out of scope?
A misused token could make unauthorized registry activity appear to come from a legitimate user or organization. In particular, an attacker with a token that had the relevant permissions could pull, push, or delete registry content within that token’s scope and the identity’s access. Unauthorized image publication is a supply-chain concern because consumers may trust an image associated with a recognized publisher. Docker called the potential supply-chain risk critical; its advisory did not provide a separate numeric severity score.
Docker says this flaw did not grant access to the Docker Hub web interface and could not be used to change a target’s password, email address, or two-factor authentication settings, or to take over the account. The researchers raised a hypothetical worst-case scenario involving Docker Official Images, but explicitly marked it unconfirmed; it should not be read as an observed or demonstrated impact. Docker says its review found no evidence that Docker infrastructure or services were affected.
Was my Docker Hub account affected?
Docker says it emailed potentially exposed users and associated organization owners on October 2, 2026. The message included relevant token descriptions and creation dates. According to Docker, users who did not receive that email were not exposed through this conversion flow. If you received it, use the message to identify the affected credentials and follow Docker’s guidance rather than relying on a token’s name alone.
What to check
- Search your email for Docker’s October 2, 2026 notification. Docker says potentially exposed users were contacted and that people who did not receive the email were not exposed through this flow.
- In Docker Hub account settings, review your personal access tokens. Revoke tokens you do not recognize or no longer use, as Docker recommends.
- For automation that belongs to an organization, use an organization access token rather than a person’s PAT, following Docker’s recommendation.
- As additional contemporaneous guidance, the researchers suggested checking the account switcher for an unfamiliar organization. They also cautioned that a token name—potentially chosen by an attacker—is not proof that the credential is legitimate.
Docker said it deactivated transferred PATs on October 8, 2026, except for tokens users had asked to keep before the deadline. That action does not change Docker’s advice to review current credentials and remove tokens that are unrecognized or unnecessary.
What Docker found in its investigation
Docker says it enumerated account conversions dating back to August 26, 2024, then correlated them with registry authentication logs, usage data, and IAM token records. It reviewed about 304,000 pushes made with transferred tokens. Docker CISO Mark Lechner wrote in the October 12 advisory: “We found no evidence that the vulnerability was exploited.”
Docker’s stated basis included that the reviewed pushes landed in the converted organization’s or new owner’s own repositories, rather than unrelated accounts. It also says static analysis of the highest-risk public images found no malware, cryptominers, command-and-control activity, credential harvesting, persistence, or tampering. Docker reported no evidence of impact to its infrastructure or services.
This is Docker’s finding from its retrospective review, not proof that no token was ever misused. Docker says registry logs show token use, but cannot reveal a transferred token that was never used. For that reason, it treated every PAT transferred during the exposure window as potentially affected, whether or not its logs showed use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Docker Hub flaw timeline
| Date and time | Event |
|---|---|
| August 26, 2024, 20:33 UTC | Docker’s stated start of the exposure window. |
| September 28–29, 2026 | The researchers’ disclosure says they reproduced the issue, with independent reproduction and impact testing on September 29. |
| September 30, 2026, 11:40 a.m. U.S. Eastern | Docker says it received the report and reproduced the issue internally. |
| September 30, 2026, approximately 3:10 p.m. U.S. Eastern (approximately 19:10 UTC) | Docker says it deployed and verified a production fix. Its advisory gives the exposure window’s approximate end as 19:10 UTC. |
| October 2, 2026 | Docker says it emailed potentially exposed users and associated organization owners. |
| October 8, 2026 | Docker says it deactivated transferred PATs, except those users had asked to keep before the deadline. |
| October 12, 2026 | Docker published its advisory and identified the issue as CVE-2026-105445. |
What Docker changed
Docker says the immediate fix removed PAT transfer during account-to-organization conversion. It also says it is adding consent and notification before someone is named an organization owner, keeping an auditable history of token-ownership changes, and reviewing other credential-ownership flows for the same pattern.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
