Docker Hub Flaw (CVE-2026-105445) Let Attackers Impersonate Users and Tamper With Images

Docker Hub Token Flaw Let Attackers Impersonate Users and Tamper With Images

Docker has disclosed a critical vulnerability, tracked as CVE-2026-105445 and scored 9.4 out of 10 on the CVSS scale, that allowed an authenticated attacker to silently hijack another user's personal access token (PAT) on Docker Hub. The flaw lived in Docker Hub's account-to-organization conversion feature and let an attacker's own token be reassigned so that it authenticated to the registry as a victim — without rotating the token secret, notifying the victim, or requiring their consent. Within the scope of that token, the attacker could then pull, push, or delete container images in the victim's repositories, including organization-owned and, in the worst case, Official Image repositories.

The bug was independently discovered by researchers Peter Molnar and Krisztian Hozak of mptrdev.com, who dubbed it "GhostPat" — a reference to a "ghost" personal access token haunting an account it was never created on. Docker says the underlying condition existed in production for roughly two years, from August 26, 2024 until the fix shipped on September 30, 2026, but an internal review of approximately 304,000 pushes made with reassigned tokens found no evidence of active exploitation.

Incident Details

How the Vulnerability Worked

A Flaw in Account-to-Organization Conversion

Docker Hub allows a personal account to be converted into an organization, with an existing Docker Hub user designated as the new owner. The vulnerability stemmed from how this conversion handled personal access tokens belonging to the account being converted: instead of invalidating or re-issuing those tokens, Docker Hub reassigned the existing PAT secret to the new owner's identity — without rotating the token, logging the change clearly, or asking the new owner to confirm the transfer.

The Exploit Chain

Molnar and Hozak demonstrated a simple, repeatable attack chain:

1. Create a throwaway Docker Hub account and generate a personal access token on it with read, write, and delete scopes.
2. Convert that account into an organization, naming the intended victim's existing username as the new owner.
3. The conversion process silently reassigned the attacker's PAT to the victim's account — no email, no in-app notification, no audit trail visible to the victim.
4. The attacker continued using the same, unmodified token, which now authenticated to the Docker Hub registry as the victim. As Docker's advisory put it, "within the scope of the token, a re-assigned PAT acted as the target user."

Because the token kept its original scopes, an attacker could use it to pull private repositories, push new image tags into the victim's namespace, or delete existing images — entirely dependent on what that token was originally permissioned to do and what repositories the victim could access, including any connected organizations.

Why It Mattered for the Software Supply Chain

The researchers flagged that the most severe realistic scenario involved Official Images — the curated, widely trusted base images (language runtimes, databases, web servers) pulled by millions of downstream builds. An attacker able to impersonate a maintainer with push access to such a repository could tamper with a widely-trusted image without needing to compromise a password, bypass multi-factor authentication, or steal session cookies — only a token transfer triggered through a self-service account conversion flow.

Impact Assessment

Recommendations

For Docker Hub Administrators and Organization Owners

• Audit existing personal access tokens on all Docker Hub accounts and organizations. Revoke any token you don't recognize or no longer need.
• Review organization membership and ownership history for unexpected additions, particularly accounts that joined via a conversion rather than an explicit invite.
• Confirm that any images pulled or built from your namespaces during the vulnerable window (August 2024 through September 2026) match expected digests, especially for externally-facing or Official Image repositories.

For Security Teams

• Treat Docker Hub PATs like any other long-lived credential: scope them tightly (read-only where possible), set expirations, and rotate them on a schedule.
• Add image provenance verification (digest pinning, signature verification via tools like docker trust or Sigstore/cosign) to CI/CD pipelines so a tampered upstream image cannot silently propagate into builds.
• Monitor for unexpected push or delete events against production image repositories, and alert on pushes authenticated by tokens your team didn't knowingly create.

For Developers and General Users

• Enable two-factor authentication on your Docker Hub account as a baseline control, even though this specific flaw did not depend on bypassing it.
• Periodically check Docker Hub's account settings for tokens you don't recall generating — Docker has stated it force-deactivated all tokens caught in the reassignment flow as of October 8, 2026, but good hygiene should not depend on a vendor cleanup.
• If you maintain or depend on publicly shared images, watch for unexpected tag updates or ownership changes and pin dependencies to specific digests rather than mutable tags.

Key Takeaways

1. CVE-2026-105445 (CVSS 9.4, CWE-266) let an attacker's personal access token be silently reassigned to a victim's identity through Docker Hub's account-to-organization conversion feature.
2. The reassigned token kept its original scopes and worked against the victim's repositories without rotating the secret or notifying the victim — a textbook incorrect-privilege-assignment flaw.
3. The vulnerability existed in production for roughly two years (August 2024 to September 2026) before researchers Peter Molnar and Krisztian Hozak reported it as "GhostPat."
4. Docker fixed the issue in under four hours of receiving the report, later notifying affected users and force-deactivating all reassigned tokens by October 8, 2026.
5. The flaw did not enable full account takeover, but it did create a real software supply chain risk — particularly around Official Images consumed by countless downstream builds.
6. Docker found no evidence of exploitation after reviewing roughly 304,000 transferred-token pushes, but organizations should still audit their own tokens and image provenance as a precaution.

Sources

• Docker Hub flaw let attackers impersonate users, tamper with images — BleepingComputer
• CVE-2026-105445: Docker Hub Vulnerability (CVSS 9.4) — Strix.ai
• GhostPat Disclosure — Peter Molnar & Krisztian Hozak (mptrdev.com)