Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

Docker has closed a critical Docker Hub weakness, tracked as CVE-2026-105445 with a CVSS 4.0 score of 9.4, that allowed one user's personal access token to act as a different account when converting a personal profile into an organization. Researchers Peter Molnar and Krisztian Hozak of mptrdev.com, who dubbed the bug GhostPat, found that naming someone else as the new organization owner silently moved that person's tokens over without their knowledge or confirmation, letting an attacker push, pull or delete images under the victim's identity. The issue existed from August 26, 2024 until Docker shipped a server-side fix on September 30, 2026 — no customer action or update is required to apply it. Docker says a review of roughly 304,000 pushes made with transferred tokens found no sign of actual abuse, but it still revoked affected tokens on October 8 and emailed impacted users on October 2, urging everyone to audit their personal access tokens and switch automation to organization-level tokens instead.