CVE-2026-105445: Docker Hub PAT Reassignment Flaw
Docker disclosed CVE-2026-105445, a critical Docker Hub flaw that can reuse reassigned personal access tokens.
Docker disclosed CVE-2026-105445, a privilege-assignment flaw in Docker Hub's personal-account-to-organization conversion. The issue is CWE-266 and has a CVSS 4.0 score of 9.4. A personal access token reassigned to another user could still be reused to pull, push, or delete images within the new owner's repository scope, creating software supply-chain risk. The excerpt does not report active exploitation.
- CVE-2026-105445 is CWE-266 incorrect privilege assignment, CVSS 4.0 9.4.
- Flaw affects Docker Hub personal-account-to-organization conversion and PAT reassignment.
- A reused token could pull, push, or delete images in the new owner's scope.
- The article does not report observed exploitation.
- CVEs
- CVE-2026-105445
- Vendors
- Docker
- Products
- Docker Hub
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105445 | Incorrect privilege assignment in Docker Hub token conversion | 9.4 | — |
From the original article
11 min read at socradar.io
CVE-2026-105445: Docker Hub PAT Reassignment Flaw Docker has disclosed CVE-2026-105445 , a critical privilege assignment flaw in Docker Hub that could allow an attacker to reuse a personal access token (PAT) after it was
By Ameer Owda · socradar.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.