Database/Container, Kubernetes & orchestration

Docker Hub: converting an account reassigned a PAT to another user without rotating the secret

CVSS 9.4CVE-2026-105445Container, Kubernetes & orchestrationcurated

Impact

Docker Hub's account-to-organization conversion reassigned a personal access token to a different user without revoking or rotating the token secret. The unchanged token then authenticated to the registry as the recipient, within its scopes, against every repository that user could reach - including organization repositories. For a fleet that pulls images from Docker Hub this is an image-integrity problem: an attacker who kept such a token could push or delete tags in repositories your nodes pull, which is a supply-chain path into every GPU node that runs the resulting container. The flaw is in Docker's hosted service, so there is nothing to patch locally; the exposure is whatever tokens survived a conversion.

Who can reach it

An authenticated Docker Hub user who controlled a PAT and used the account-to-organization conversion flow. Remote, no access to the victim's credentials required.

What to do

No operator patch - Docker fixed the service side. Audit and rotate Docker Hub personal access tokens that belonged to accounts converted into organizations, review registry audit logs for unexpected pushes or deletions in repositories your clusters pull from, and verify image digests pinned in your manifests against what you expect. Pulling by digest rather than tag limits a future repeat.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-105445 https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/https://docs.docker.com/accounts/organization/setup/convert-account/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.