Docker Hub has resolved a critical security vulnerability (CVE-2026-105445) where personal access tokens (PATs) were reassigned without confirmation when personal accounts were converted to organizations. This could have allowed unauthorized registry-level access to repositories. The fix was deployed swiftly and affected users were notified.
- Personal access tokens transferred to new owners without consent during account conversion
- Patch deployed within hours of discovery, with retrospective account reviews
- No detected exploitation, but affected tokens were revoked to prevent risk
Infrastructure signal
Docker Hub’s identity and access management system had a design gap where converting a personal account into an organization also transferred the ownership of personal access tokens (PATs) by altering their owner records without revoking or rotating them. This flaw impacted token management at the registry authentication level, enabling a reassigned PAT to impersonate the new assigned owner within allowed scopes such as repository image pulls, pushes, and deletions.
From an infrastructure perspective, this vulnerability exposed a supply chain risk related to container image registries and highlights the importance of strict token lifecycle controls tied to account ownership changes. Docker responded by removing token transfer logic entirely from the conversion process and instituting retrospective account audits and targeted token deactivation.
Developer impact
Developers relying on Docker Hub’s repository migration via account-to-organization conversions should be aware that personal access tokens may have been reassigned silently in the past, posing risks to both image integrity and access controls. While the flaw did not permit web interface access or change account credentials, it allowed potential registry-level token misuse within scope.
The swift fix restores developer confidence by removing unauthorized token transfers during conversions and enforcing expiration or revocation of exposed PATs. Developers should review personal access tokens in their settings for suspicious or unknown tokens. This event underscores the necessity of token rotation and awareness of token permissions in CI/CD pipelines and automation workflows dependent on Docker Hub images.
What teams should watch
Security and platform teams managing container registries and developer infrastructure platforms should monitor token ownership policies closely, especially when account migration or conversion workflows are involved. They should verify that personal access tokens explicitly require user confirmation on ownership changes and that critical token operations trigger notifications or authentication challenges.
Observability into token usage was a limitation, as logs only capture token activity, not token existence, complicating detection of dormant abuse. Teams should augment observability for token-related actions and consider periodic audits and automated token rotation policies. Collaboration between identity, security, and development teams is recommended to avoid silent trust assumptions in token scope changes and to maintain robust cloud infrastructure hygiene.