Docker Hub Critical Vulnerability (CVE-2026-105445) Exposed User Impersonation Risk
Docker recently disclosed a critical vulnerability in Docker Hub, identified as CVE-2026-105445 (dubbed GhostPat), which allowed attackers to impersonate other users at the container registry level. The flaw, reported by researchers Peter Molnar and Krisztian Hozak of mptrdev.com on September 30, 2026, stemmed from how Docker handled personal access tokens (PATs) during account conversions.
The vulnerability exploited Docker Hub’s process for converting personal accounts into organizations. When a user converted an account into an organization and assigned an existing account as its owner, the original account’s PATs were reassigned to the new owner without rotation or revocation. Attackers could create a disposable account, generate a PAT, convert it into an organization, and designate a victim as the owner without the victim’s knowledge or consent. This granted the attacker access to the victim’s private repositories, enabling unauthorized image downloads, malicious uploads, or deletions, depending on token permissions.
The exposure window spanned over two years, from August 26, 2024, to September 30, 2026, though Docker deployed a fix within four hours of the report. Public disclosure followed on October 12, 2026.
While the flaw posed a significant software supply chain risk particularly through modified images under trusted namespaces Docker confirmed it did not allow web interface access, password changes, or full account takeover. The company conducted a thorough investigation, analyzing 304,000 image pushes tied to transferred tokens and found no evidence of exploitation. Static analysis of high-risk public images also revealed no malware, cryptominers, or tampering.
However, Docker noted that unused transferred tokens would not appear in logs, so affected credentials were identified via conversion history. On October 2, 2026, Docker notified impacted users and organization owners, deactivating transferred PATs on October 8 (unless owners opted out). The fix now prevents token transfers during conversions and introduces ownership consent, notifications, and auditable token histories.
Docker clarified that users who did not receive a notification were not exposed to this vulnerability. The company continues to enhance security measures to mitigate similar risks.
Source: https://gbhackers.com/critical-docker-hub-vulnerability/
Docker, Inc cybersecurity rating report: https://www.rankiteo.com/company/docker
"id": "DOC1791973892",
"linkid": "docker",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users and organizations with '
'transferred PATs during account '
'conversions',
'industry': 'Technology/Cloud Services',
'name': 'Docker Hub',
'type': 'Container Registry'}],
'attack_vector': 'Personal Access Token (PAT) reassignment during account '
'conversion',
'customer_advisories': 'Users who did not receive a notification were not '
'exposed to the vulnerability.',
'data_breach': {'data_exfiltration': 'Possible (unauthorized downloads)',
'file_types_exposed': 'Container images (Docker images)',
'sensitivity_of_data': 'Private repositories (potentially '
'proprietary or sensitive images)',
'type_of_data_compromised': 'Container images, repository '
'metadata'},
'date_detected': '2026-09-30',
'date_publicly_disclosed': '2026-10-12',
'date_resolved': '2026-09-30',
'description': 'Docker disclosed a critical vulnerability in Docker Hub '
'(CVE-2026-105445, dubbed *GhostPat*), which allowed attackers '
'to impersonate other users at the container registry level. '
'The flaw stemmed from how Docker handled personal access '
'tokens (PATs) during account conversions, enabling '
'unauthorized access to private repositories.',
'impact': {'brand_reputation_impact': 'Software supply chain risk, potential '
'reputational damage',
'data_compromised': 'Private repositories (images, metadata)',
'operational_impact': 'Unauthorized image downloads, malicious '
'uploads, or deletions',
'systems_affected': 'Docker Hub container registry'},
'investigation_status': 'Completed (no evidence of exploitation found)',
'lessons_learned': 'Vulnerabilities in account conversion processes can lead '
'to unauthorized access; token rotation and revocation are '
'critical during ownership changes; auditable token '
'histories and user consent are essential for security.',
'post_incident_analysis': {'corrective_actions': 'Fixed token transfer during '
'conversions; introduced '
'ownership consent, '
'notifications, and '
'auditable token histories.',
'root_causes': 'Flaw in Docker Hub’s account '
'conversion process where PATs were '
'reassigned to new owners without '
'rotation or revocation; lack of '
'ownership consent and auditable '
'token histories.'},
'recommendations': 'Rotate all PATs after account conversions; implement '
'ownership consent mechanisms; enhance monitoring for '
'unusual token activity; conduct regular security audits '
'of account management processes.',
'references': [{'source': 'Docker Security Advisory'},
{'source': 'mptrdev.com (Peter Molnar and Krisztian Hozak)'}],
'response': {'communication_strategy': 'Public disclosure on October 12, '
'2026; notifications to affected users '
'on October 2, 2026',
'containment_measures': 'Fix deployed within 4 hours of report; '
'deactivation of transferred PATs on '
'October 8, 2026',
'enhanced_monitoring': 'Static analysis of high-risk public '
'images; log analysis for transferred '
'tokens',
'incident_response_plan_activated': 'Yes',
'recovery_measures': 'Notified impacted users and organization '
'owners; analyzed 304,000 image pushes for '
'exploitation evidence',
'remediation_measures': 'Prevented token transfers during '
'conversions; introduced ownership '
'consent, notifications, and auditable '
'token histories'},
'stakeholder_advisories': 'Notified impacted users and organization owners on '
'October 2, 2026; deactivated transferred PATs on '
'October 8, 2026 unless opted out.',
'title': 'Docker Hub Critical Vulnerability (CVE-2026-105445) Exposed User '
'Impersonation Risk',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2026-105445 (*GhostPat*)'}