CVE-2026-105445: Docker Hub Personal Access Token Impersonation Vulnerability — Analysis & Mitigation

On October 12, 2026, Docker disclosed CVE-2026-105445, a critical vulnerability in Docker Hub that let an attacker impersonate another user at the container registry level using only a personal access token created on their own account. Dubbed "GhostPat" by the researchers who found it, the flaw lived in the account-to-organization conversion flow for over two years — and it is a textbook identity access management failure: the system changed who a token belonged to without changing the secret that proved ownership.

Summary

Docker Hub is the world's largest container image registry. A personal access token (PAT) there acts as a password substitute: CI/CD pipelines and automation tools use PATs to pull, push, or delete images. CVE-2026-105445 broke the binding between a token and its owner. When a user converted a personal account into an organization — a flow requiring them to name an existing user as the new organization's owner — Docker Hub silently reassigned that account's PATs to the new owner. The ownership record changed, but the token secret never rotated, and the new "owner" was never asked for consent or notified.

The abuse is brutally simple: create an account, generate a PAT, convert the account into an organization, name your target as owner. You keep the original secret — and it now authenticates to the registry as the target. Within the token's scope, the attacker could pull, push, or delete images in the target's repositories and in any organization the target could access — including publishing malicious images under a legitimate name.

Introduced August 26, 2024, reported September 30, 2026 by Peter Molnar and Krisztian Hozak (mptrdev.com), fixed by Docker in under four hours. Advisory: October 12. CVE record (CVSS 4.0 9.4): October 13.

Severity

• CVE ID: CVE-2026-105445
• CVSS 4.0: 9.4 (Critical)
• Attack requirements: Only a free Docker Hub account — remote, low complexity, no privileges on the target, no action needed from the victim
• Impact: Full registry-level impersonation within the token's scope — pull, push, delete as the target
• Exploited in the wild: Docker reviewed every account conversion since introduction (~304,000 pushes) and found no evidence of exploitation

The 9.4 reflects remotely exploitable, low-complexity compromise with high integrity impact: the attacker writes data the ecosystem trusts as the victim's. Docker rated it critical for the software supply chain risk — a poisoned image published under a legitimate name flows into thousands of automated deployments.

Affected Versions

This was server-side in Docker Hub itself — no version to check, no patch to install. Exposure window: August 26, 2024 – September 30, 2026. Only accounts that received transferred tokens during a conversion were affected. Docker emailed them on October 2, 2026 and deactivated the transferred tokens on October 8 (unless owners asked to keep them). Docker's guidance: no email, no action needed.

Technical Analysis

How the Attack Worked

1. Token creation. Attacker creates a Docker Hub account, generates a PAT with registry scope, keeps the secret.
2. Conversion. Attacker converts the account into an organization, naming the target as owner.
3. Silent reassignment. Docker Hub moves the token's ownership record to the target — no secret rotation, no revocation, no consent, no notification.
4. Impersonation. The attacker authenticates with the retained secret; the token now operates as the target.

The victim experiences nothing — no email, no consent screen, no visible account change. Checking your own settings would never reveal that someone else holds a live credential bound to your identity.

The Bug Class: Bearer Credentials Treated as Transferable Assets

As a penetration tester, this is the seam I hunt for: two correct-looking behaviors combining into a broken one. Tokens are bearer credentials — whoever presents the secret is authenticated. Account conversion transfers assets to a new owner. The flaw was treating a bearer credential as a transferable asset: like changing the name on a house deed while the old owner keeps a copy of the key.

The secure design is standard — rotate or revoke credentials on any ownership change — and Docker has now implemented it, along with the second missing control: an audit signal. Security-relevant state changes must always produce a user-visible event. Docker now requires consent before a user can be named an organization owner and records token ownership changes in an auditable history. Automated scanners never find business-logic flaws like this; humans asking "what happens if I abuse this flow?" do.

Identity Access Management Failure: Why Token Lifecycle Is Everything

Identity access management means the right identities get the right access — and access dies when the relationship changes. CVE-2026-105445 is IAM failure in pure form: the identity on a credential was rewritten while the access survived. This matters beyond Docker Hub because PATs are the skeleton keys of modern engineering: they live in CI/CD secrets, build scripts, and laptops, often broadly scoped with no expiry. When a platform mishandles token lifecycle, the blast radius is every system trusting the registry. If your pipelines pull base images from Docker Hub — most do — GhostPat-style impersonation is a supply chain injection into your build. I previously analyzed a critical RCE in GitLab CI/CD pipelines — exactly the infrastructure that consumes these images automatically.

Why This Matters for the Security of Cyberspace

The security of cyberspace rests on shared registries — Docker Hub, npm, PyPI — that function as critical infrastructure. One logic flaw in any of them poisons software consumed by millions. Docker's response deserves credit: sub-four-hour fix, full historical review, direct notification, structural changes. But note the honest caveat: for transferred tokens that were never used, registry logs record nothing (logs capture usage, not existence), so those were treated as potentially affected on principle. "No evidence of exploitation" is bounded by what logs can see — which is why digest pinning and image signing (Docker Content Trust, Sigstore) are not optional hardening but the real last line of defense when the registry itself breaks. A related identity-spoofing flaw at the network edge: my analysis of CVE-2026-104935, the Ivanti Connect Secure authentication bypass.

What does vulnerable mean in the context of CVE-2026-105445? It means a trusted platform could silently bind your identity to someone else's credential for two years, with no signal you could ever have seen. How does this affect the security of cyberspace's software supply chain? It proves registries are only as trustworthy as their least-examined account flow — and that provenance verification is the defense that survives even a compromised registry.

Mitigation

• Check for Docker's email (October 2, 2026). Received it? Rotate your PATs immediately and review repos and organizations for unexpected pushes, deletions, or digest changes.
• No email = no action required — but audit anyway: delete unused PATs, narrow scopes to minimum repositories.
• Rotate tokens on any account change: conversions, ownership transfers, team changes.
• Pin image digests in production instead of floating tags, so a registry compromise cannot silently swap what you deploy.
• Enable image signing and verification (Docker Content Trust / Notary, Sigstore).

Docker's server-side fixes: token transfer removed from conversion, consent now required to name an organization owner, auditable token-ownership history, plus an audit of other credential-transfer flows. Note the advisory's boundary: the flaw never granted Docker Hub web access and could not change passwords, email, or 2FA — registry-level impersonation only. That is precisely why digest pinning and signature verification matter: they protect the layer the platform could not.

References

• BleepingComputer — "Docker Hub flaw let attackers impersonate users, tamper with images": https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/
• The Hacker News — "Docker Fixes Critical Two-Year-Old Hub Flaw": http://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html
• Docker security advisory (mirror): https://daily.dev/posts/docker-hub-security-advisory-cve-2026-105445-ash3twcdv
• SC Media brief: https://www.scworld.com/brief/docker-hub-critical-vulnerability-allowed-token-misuse

More from this blog: about Faizan Akhtar.

Report by Faizan Akhtar — The Cyber Security Researcher