Source: Docker security advisory
Docker has published a security advisory for CVE-2026-105445, a critical vulnerability in Docker Hub that let a personal access token be re-assigned to another user during an account-to-organization conversion. Because the token secret was never rotated and the new owner was never asked to confirm, an attacker who converted an account and named a victim as the new owner could keep using their own token to authenticate to the registry as the victim. That includes pulling, pushing and deleting images, which Docker classifies as a software supply chain risk.
What happened and what Docker found
The flaw was introduced on August 26, 2024 and fixed on September 30, 2026, less than four hours after researchers Peter Molnar and Krisztian Hozak reported it through Docker’s disclosure program. The vulnerability did not grant access to the Docker Hub web interface and could not change passwords, email addresses or two-factor settings. Docker reviewed every conversion since the flaw was introduced, examined roughly 304,000 pushes made with transferred tokens, and found no evidence of exploitation, no malware in the highest-risk images, and no impact on its own infrastructure. On October 8, Docker force-deactivated every personal access token that had been transferred through a conversion. Exposed users were notified by email on October 2.
What your team should do now
If your CI/CD pipelines pull from or push to Docker Hub, check whether you received Docker’s notification email dated October 2, and verify that no stale personal access tokens survive in your automation. The practical lesson is broader: registry credentials are part of your software supply chain, so they need the same rotation, scoping and audit discipline as production secrets.
If you want help auditing your CI/CD credentials, tightening container supply chain security or setting up automated secret rotation, contact Excello Digital at https://excello.digital/contact/. We help European teams secure their pipelines without slowing them down.