Docker Hub's PAT Vulnerability: What Changed and Your Next Steps

Docker Hub recently addressed a critical security vulnerability involving personal access tokens (PATs), which were unintentionally transferred during account-to-organization conversions. This flaw was identified on September 30, 2026, and Docker responded swiftly with a fix the same afternoon. Here’s what you need to know about the issue, the potential risks, and the steps you should consider to secure your account.

Understanding the Vulnerability

The vulnerability, tracked as CVE-2026-105445, arose from the process of converting personal accounts into organizations on Docker Hub. This conversion is necessary for users who want to maintain existing repository references without disruption. The flaw, introduced on August 26, 2024, resulted in the unintended transfer of PATs to the new organization owner without notification or confirmation.

During the conversion process, the converted account’s PATs were reassigned to the new owner. This reassignment was done by changing the token’s owner record without rotating or revoking the token secret. The new owner was neither asked to confirm nor notified about this change, which created a potential security gap. An attacker could exploit this by creating an account, generating a PAT, converting the account to an organization, and assigning a target user as the owner. The PAT would then authenticate at the registry level with the target user’s scope, allowing the attacker to potentially manipulate images within the target’s repositories.

To illustrate, if an attacker had targeted a user with access to sensitive repositories, they could have used the reassigned PAT to push malicious images or delete critical ones, disrupting services relying on those images. Such actions could have serious implications for software supply chains, especially if the images were part of a production environment.

Impact and Response

Docker classified this as a critical software supply chain risk because it allowed unauthorized actions like pulling, pushing, or deleting images. The re-assigned PAT acted as the target user at the registry level, meaning that within the scope of the token, an attacker could perform actions under the legitimate user’s credentials. However, the vulnerability did not grant access to Docker Hub’s web interface or allow changes to account credentials such as passwords or two-factor authentication settings.

The exposure window ran from August 26, 2024, 20:33 UTC, until the fix was deployed on September 30, 2026, at approximately 19:10 UTC. During this period, any PAT transferred through conversion could have been used with the target user’s privileges, but Docker’s investigation found no evidence of actual exploitation. Most conversions occurred between accounts controlled by the same person or team, which is standard practice. Additionally, Docker found no malicious activity within the images pushed after conversions.

Despite the lack of evidence for exploitation, the potential consequences were significant enough to warrant a critical rating. The risk of unauthorized image manipulation could have led to breaches in data integrity and availability, posing severe risks to users relying on Docker for their application deployments.

Mitigation Measures by Docker

Docker’s immediate fix removed PAT transfers from the account conversion process. They have also implemented further changes to enhance security:

• Consent is now required before a user can be named as an organization owner, along with a notification when this occurs. This change ensures that users are aware and approve of being assigned as organization owners, preventing unauthorized assignments.
• An auditable history of token ownership changes will be maintained to ensure transparency and accountability. This record allows Docker and its users to trace any changes in token ownership, providing a clear audit trail for security reviews.
• Docker is reviewing other credential ownership change flows to prevent similar vulnerabilities. This proactive approach aims to identify and address any potential security gaps in other processes that involve credential changes.

Steps for Docker Hub Users

As a Docker Hub user, it’s essential to review your personal access tokens regularly. Here’s what you can do:

• Log in to Docker Hub and navigate to Account settings > Personal access tokens. Revoke any tokens you don’t recognize or no longer use. Regularly auditing your tokens helps maintain control over who has access to your account.
• For automation tasks, especially those belonging to an organization, consider using organization access tokens instead of personal PATs. Organization access tokens provide a more secure and manageable way to handle automation, reducing the risk associated with personal tokens.
• If you suspect any unusual activity or have questions, reach out to Docker Support through their contact page. Promptly addressing any concerns can prevent potential security breaches.

More information about handling security vulnerabilities can be found in similar scenarios, such as the Next.js security update or handling health check endpoints in Node.js with Express.

Honest Limitations and Considerations

While Docker has addressed this particular vulnerability, there are inherent limitations. The investigation could only confirm misuse where a transferred token was actively used. Tokens that were transferred but not used leave no trace, which is a gap in detection capabilities. Docker's proactive approach in treating all potentially affected tokens as exposed is commendable, but it highlights the importance of continuous monitoring and security awareness.

For those managing multiple accounts or organizations, it’s crucial to implement robust access management practices. This includes regular audits of access tokens and ensuring that only necessary permissions are granted. In my experience, using role-based access control (RBAC) can greatly enhance security by limiting access based on the user’s role and responsibilities.

Given the critical nature of such vulnerabilities, maintaining a strong security posture requires ongoing diligence and adaptation to new security practices. Regular updates and training on security best practices for all team members can help mitigate risks associated with human error.

Your Next Steps with DevOps Best Practices

If you’re managing Docker in your DevOps workflow, consider integrating security checks into your CI/CD pipeline to monitor and manage access tokens effectively. Utilizing tools that provide insight into token usage patterns and alert you of any anomalies can help detect unauthorized access early.

Learning from past vulnerabilities can also help enhance your security strategies. For example, the transition from cgroup v1 to v2 in Kubernetes shows how aligning with updated systems can offer better resource management and security. Keeping your systems up to date with the latest security patches and updates is vital in protecting against known vulnerabilities.

Overall, the key takeaway is to remain vigilant and proactive in managing access credentials. Regularly update your knowledge on security practices and stay informed about new vulnerabilities and their mitigations. Engaging with the security community and participating in forums or discussions can also provide valuable insights and keep you ahead of potential threats.