Incorrect Privilege Assignment in Docker Hub's Account Conversion Feature

CVE-2026-105445

What is CVE-2026-105445?

An Incorrect Privilege Assignment flaw exists in Docker Hub's feature that converts accounts to organizations. This vulnerability permits an authenticated user to reassign a personal access token (PAT) they own to another user within Docker Hub without any necessary rotation or revocation of the token's secret. This unchanged PAT then allows the recipient to authenticate to the registry, granting them the capability to pull, push, or delete repository images according to the token's scopes, including those belonging to organizations. This exposes repositories to unauthorized activities, creating significant security risks.

News Articles

The Hacker News

CVE-2026-105445

Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

Docker fixed a critical Hub account conversion flaw that let transferred tokens push images as other users; it found no evidence of exploitation.

2 hours ago

BleepingComputer

CVE-2026-105445

Docker Hub flaw let attackers impersonate users, tamper with images

Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT).

5 hours ago

References