CVE-2026-105445

CVE-2026-105445 is a vulnerability in Docker Hub's identity and access management system, specifically within the feature that converts a personal account into an organization. When a personal account is converted, the user must designate an existing account as the organization's owner. The flaw occurred because this conversion process transferred the original account's personal access tokens (PATs) to the designated owner's account without changing or revoking the token's secret. Consequently, an attacker could create a personal account, generate a PAT, and convert that account into an organization while naming a target user as the owner. Because the token's ownership record was updated to the victim but the secret remained the same, the attacker could use the token to authenticate as the target user. This flaw allowed unauthorized users to impersonate victims to pull, push, or delete container images in their personal repositories and connected organizations, depending on the token's permissions. However, the vulnerability was limited to registry access; it did not grant access to the Docker Hub web interface, nor could it be used to change passwords, email addresses, or two-factor authentication settings. Discovered by security researchers who dubbed it "GhostPat," the exposure window lasted from August 26, 2024, until Docker deployed a backend fix on September 30, 2026. Docker reported finding no evidence of active exploitation in the wild.