CVE-2026-105445: Docker Hub account conversion could reassign an active personal access token to another user
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated to Docker Hub and control a personal access token. They use the account-to-organization conversion feature to reassign that token to another Docker Hub user.
What could an attacker do with a reassigned token?
Because the token secret remains unchanged, it authenticates to the registry as the recipient user. Within the token's scopes and the recipient's repository access, it can pull, push, or delete images, including images in organization repositories.
Who is exposed to the greatest impact?
Users whose Docker Hub account access includes organization repositories are particularly exposed. A reassigned token can act with that user's repository permissions, subject to the token's configured scopes.