Affected Systems

Docker Hub users who converted personal accounts to organizations between August 26, 2024, and September 30, 2026 (two-year window). Personal Access Tokens (PATs) were transferred to designated organization owners without notification. Approximately 304,000 pushes involved transferred tokens. No Docker software updates required; flaw was server-side.

Exploitation Status

No evidence of exploitation found. Docker reviewed all account conversions during the vulnerability window, analyzed 304,000 pushes made with transferred tokens, and found no malicious activity. Proof-of-concept demonstrated by researchers Peter Molnar and Krisztian Hozak (mptrdev.com) on consenting test accounts. Affected tokens were deactivated on October 8, 2026.

Business Impact

Attackers could have created a PAT, converted their account to an organization naming a victim as owner, then used the token to push malicious images, pull private images, or delete repositories under the victim's identity in Docker Hub registry. Access was registry-only (no web UI, no account takeover). Docker rated this critical (CVSS 4.0: 9.4, CVE-2026-105445) due to supply chain risk—malicious images published under legitimate names could propagate widely. Limited number of users received notification; those not emailed are not affected.

Urgency

🟡 Within a week

Recommended Actions

  • Check for Docker notification emails sent October 2, 2026; if none received, no action required
  • Review Personal Access Tokens in Docker Hub Account Settings: revoke any tokens not created by you or last used during August 2024–September 2026 that you don't recognize
  • Audit Docker Hub organizations in account switcher for unexpected memberships added during the vulnerability window
  • Verify image signatures and CI/CD build provenance for images published between August 2024 and September 2026, especially if you converted accounts during that period
  • Migrate automation from personal PATs to organization access tokens (requires Docker Team or Business subscription) to prevent future token misuse