---
id: 2026-10-docker-hub-ghostpat-pat-transfer-account-conversion-cve-2026-105445
title: "Docker Hub account-to-organization conversion handed a live personal access token to a named victim (GhostPat, CVE-2026-105445, 9.4), open 2024-08-26 to 2026-09-30; fixed"
date_disclosed: 2026-10-12
last_updated: 2026-10-14
severity: high
status: patched
ecosystems: [docker, container-registry, supply-chain, ci-cd]
tools_affected: ["Docker Hub users and organizations whose owners could be named by any account during a conversion (2024-08-26 to 2026-09-30)", "CI pipelines that push images with a personal access token rather than an organization access token"]
tags: [cve, docker-hub, personal-access-token, token-transfer, account-conversion, registry, supply-chain, image-push, platform-fix, patched]
---

## TL;DR
From 2024-08-26 until 2026-09-30, converting a Docker Hub personal account into an organization re-assigned that account's personal access tokens to whoever was named as the organization's owner, without rotating the secret, asking the named user, or telling them. An attacker who created a token on a throwaway account, converted it, and named a victim as owner kept a token that authenticated to the registry as the victim: pull, push and delete in the victim's repositories and in organizations the victim could access, within the token's scopes, but no web login, password, email or 2FA change. Peter Molnar and Krisztian Hozak (mptrdev.com) reported it on 2026-09-30; Docker fixed it in under four hours, emailed affected token recipients on 10-02, deactivated the transferred tokens it could identify on 10-08, published its advisory on 10-12, and the CVE record (CNA Docker, CVSS 4.0 9.4) followed on 10-13. Docker reviewed every conversion in the window and about 304,000 pushes made with transferred tokens and found no push into an unrelated account and no tampered image among the highest-risk public ones. Nothing to upgrade; check your token list and, if you received the 10-02 email, your push history.

## What happened

### The mechanism

Docker Hub's account conversion turns a personal account into an organization and asks for a user to become the organization's owner. Until the fix, the conversion moved the converted account's personal access tokens (PATs) to that owner: the owner record changed, the secret did not. The named owner was neither asked to confirm nor notified. Docker's advisory lists the attack in four steps: create an account and a PAT, convert the account naming the target as owner, keep the secret, authenticate to the registry as the target. The researchers reproduced it twice on consenting test accounts (2026-09-28 and 09-29) and demonstrated logging in as the victim with the minted token, pushing into the victim's namespace and into an organization the victim belonged to, pulling the victim's private repositories, and the victim's inbox staying empty throughout. They flagged the worst case, a push into an Official Image under `library/`, as unconfirmed.

Docker's own documentation had described the transfer as a feature from 2025-04-22 (a docs commit adding the note) until the fix day, when a second commit removed it. The CNA record's affected range is a date range, `2024-08-26T20:33Z` to `2026-09-30T19:10Z`, and the weakness is CWE-266, incorrect privilege assignment.

### The review

Docker says it reviewed every account conversion since 2024-08-26 and about 304,000 pushes made with transferred tokens: every push landed in the converted organization's own repositories or in the named owner's, none in an unrelated account, and the highest-risk public images were analysed statically with no malware, miner, command-and-control, credential harvesting, persistence or tampering found. Docker also says the logs show only tokens that were used, so an unused transferred token leaves no trace; for that reason it treated every PAT transferred in the window as potentially affected and deactivated the ones it identified on 2026-10-08, except those their owners asked to keep. The advisory does not report results for pulls or deletions with transferred tokens, which The Hacker News notes and this file repeats as a gap.

### The fix

Removed server-side on 2026-09-30, so no customer update exists: PATs no longer transfer on conversion and the new owner must create their own, with organization access tokens recommended; a user must now consent before being named an organization owner and is notified when it happens; every token ownership change is recorded; Docker is reviewing other flows that change credential ownership. The researchers had recommended an explicit approval step and invalidation of carried-over tokens; the consent step and the 10-08 deactivation match that.

### Severity

The CNA scores 9.4 Critical (`AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`) and Docker calls it critical because a transferred token could publish images under legitimate names. This advisory rates it high: the flaw is closed on the only system where it existed, the identified tokens are dead, two years of pushes were reviewed with nothing found, and what remains for a reader is an audit. The 9.4 is the right number for the window; the rating here is for the reader on 2026-10-14. Both are printed so the difference is visible.

### Why it belongs here

A container image pushed by a CI pipeline is the deployment artefact for most vibe-coded backends, and the credential that pushes it is very often a personal PAT in a GitHub Actions secret. This bug made that PAT's identity transferable by a stranger. It is the second registry-identity bug this month after [npm's slug rebinding](2026-10-npm-trusted-publishing-slugfest-repository-slug-rebinding-bloom.md), and the same lesson applies: the registry's model of who you are is a credential, and it can be reassigned without your secret changing.

## Am I affected?

- **Did you receive Docker's email of 2026-10-02 with the subject "Docker Hub Vulnerability Identified & Resolved"?** Docker says that if you did not, no PAT on your account was transferred and no action is needed.
- Account settings, then Personal access tokens: for each token, read the creation date and last-used date. A token you did not create, whatever its name, is the artefact; revoke it.
- The account switcher: an organization you do not recognise is a conversion that named you.
- Organization owners: activity logs in Docker Home cover 30 days; older pushes are available through the Docker Hub API. A push to one of your repositories from a token you did not issue, between 2024-08-26 and 2026-10-08, is what to look for.

```bash
# Tags on your images and when they were pushed (public repos; adapt the namespace)
curl -s "https://hub.docker.com/v2/repositories/<namespace>/<repo>/tags?page_size=100" \
  | python3 -c 'import json,sys; [print(t["last_updated"], t["name"]) for t in json.load(sys.stdin)["results"]]'
```

A tag pushed on a date your pipeline did not run, or a digest that does not match the build your CI recorded, needs the image-signing or CI-log comparison one affected team described in The Hacker News piece.

## If you are affected

Revoke the token, rotate any PAT a pipeline uses to an organization access token, and compare recent image digests against CI build records. If an image you ship was replaced, follow [if your webapp was compromised](../playbooks/if-your-webapp-was-compromised.md) for the deployed side and [ci-cd-hardening](../prevention/ci-cd-hardening.md) for the pipeline.

## Prevention

- Use organization access tokens for automation, not a person's PAT; the person's token carries every organization they can reach.
- Sign images and verify the signature in deployment, so a push by a stranger with your identity fails downstream.
- Review registry tokens on the same cadence as cloud keys: [credential-hygiene](../prevention/credential-hygiene.md), [rotating cloud credentials](../playbooks/rotating-cloud-credentials.md).

## Sources
- [Docker — Docker Hub Security Advisory: CVE-2026-105445](https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/) (2026-10-12; mechanism, window, token capabilities, the 304,000-push review, fix, user actions, credits)
- [CVE Services — CVE-2026-105445](https://cveawg.mitre.org/api/cve/CVE-2026-105445) (CNA Docker, published 2026-10-13; date-range affected versions, CVSS 4.0 9.4, CWE-266, credits Peter Molnar and Krisztian Hozak of mptrdev.com)
- [GhostPat — researchers' write-up](https://ghostpat.com/) (reproductions 2026-09-28 and 09-29, report 09-30 11:40, fix about 15:10, what was demonstrated on test accounts, recommendations)
- [The Hacker News — Docker fixes critical two-year-old Hub flaw that let one user push images as another](https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html) (2026-10-13; the docs-commit dates and the pull/delete reporting gap)
- [Docker docs — Convert an account into an organization](https://docs.docker.com/accounts/organization/setup/convert-account/) (current text: PATs do not transfer)