CVE-2026-105445

Docker Hub's account-to-organization conversion feature had an incorrect privilege assignment flaw (CWE-266) that let an authenticated attacker reassign a personal access token they controlled to another Docker Hub user without rotating or revoking the token secret. Because the secret stayed the same, that PAT then authenticated to the registry as the recipient. Within the token's scopes, the attacker could pull, push, or delete images in repositories the recipient could access, including organization repositories. Anyone with a Docker Hub account that could be the target of such a reassignment is affected; no fixed product version is stated in the advisory data. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Revoke and recreate all Docker Hub personal access tokens, and review organization membership, repository permissions, and audit or activity logs for unexpected account-to-organization conversions, token reassignments, or image pull, push, or delete events. Treat any PAT that may have been reassigned as compromised even if its secret never changed, and restrict token scopes to the minimum required until Docker confirms the conversion feature is fixed.