Docker Hub Security Advisory: CVE-2026-105445 | Docker

This post details a critical vulnerability (CVE-2026-105445) in Docker Hub's account-to-organization conversion process where personal access tokens (PATs) were re-assigned to the new owner without their explicit consent or knowledge. It outlines the vulnerability's mechanism, its potential impact (registry-level access, including push/pull/delete of images), and its limitations (no access to web interface, password, or account settings). The post provides a timeline of the incident, the investigation findings (no evidence of exploitation found), the actions taken for affected users (email notification, PAT deactivation), and the changes implemented to prevent recurrence, including requiring consent for owner assignment, auditable token ownership history, and review of other credential ownership flows. It also provides recommendations for users to review their PATs and use organization access tokens for automation.