--- title: Docker Hub Security Advisory: CVE-2026-105445 | daily.dev description: Docker disclosed CVE-2026-105445, a Docker Hub flaw where converting a personal account into an organization could re-assign that account's personal access... canonical: https://daily.dev/posts/docker-hub-security-advisory-cve-2026-105445-ash3twcdv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Docker Hub Security Advisory: CVE-2026-105445 | daily.dev og:description: Docker disclosed CVE-2026-105445, a Docker Hub flaw where converting a personal account into an organization could re-assign that account's personal access... og:url: https://daily.dev/posts/docker-hub-security-advisory-cve-2026-105445-ash3twcdv og:image: https://api.daily.dev/og/posts/AsH3tWcDv.png og:image:alt: Docker Hub Security Advisory: CVE-2026-105445 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Docker Hub Security Advisory: CVE-2026-105445 **[Docker](https://daily.dev/sources/docker)** · 6 min read · 0 upvotes · 0 comments ## Summary Docker disclosed CVE-2026-105445, a Docker Hub flaw where converting a personal account into an organization could re-assign that account's personal access tokens to the named new owner without rotating the token secret or notifying the owner, letting an attacker's token authenticate as the target user. The bug existed from August 26, 2024 until a fix shipped September 30, 2026, hours after responsible disclosure by researchers Peter Molnar and Krisztian Hozak. Docker reviewed roughly 304,000 pushes made with transferred tokens, found no evidence of exploitation or malicious images, notified affected users on October 2, force-deactivated transferred tokens on October 8, and is now requiring owner consent for conversions, logging token ownership changes, and auditing other credential-transfer flows. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was CVE-2026-105445 in Docker Hub and what could an attacker do with it? CVE-2026-105445 was a Docker Hub flaw where converting a personal account into an organization re-assigned the converted account's personal access tokens to the newly named owner without rotating the token secret or asking for confirmation. An attacker could create an account, generate a PAT, convert the account naming a target user as owner, and keep using that PAT to pull, push, or delete images under the target's identity and repository access. _daily.dev surfaces security advisories like this one for engineers auditing their container registry access._ ### How long was the Docker Hub token re-assignment vulnerability active before it was patched? The vulnerability existed from August 26, 2024, 20:33 UTC, until a fix was deployed on September 30, 2026, at approximately 19:10 UTC. Docker received the researcher report at 11:40 AM Eastern that same day and deployed the fix to production less than four hours later, around 3:10 PM Eastern. _Track how quickly vendors patch supply-chain-relevant CVEs by following security advisories on daily.dev._ ### Did Docker find evidence that the Hub account conversion token vulnerability was exploited? No evidence of exploitation was found. Docker examined about 304,000 pushes made with transferred tokens and found every one landed in either the converting organization's own repositories or the new owner's own repositories, never an unrelated account; static analysis of the highest-risk public images turned up no malware, cryptominers, or credential harvesting. _daily.dev helps developers keep up with incident postmortems when deciding how much to trust a registry._ ## Similar posts on daily.dev - [Security Incident Disclosure \(Homebrew\)](https://daily.dev/posts/security-incident-disclosure-homebrew--fs6uj8yxw) · Lobsters · 0 upvotes · 0 comments - [Trivy supply chain compromise: What Docker Hub users should know](https://daily.dev/posts/trivy-supply-chain-compromise-what-docker-hub-users-should-know-xwl2y9gbl) · Docker · 8 upvotes · 0 comments - [Docker 29.9.0 Security Update: Five Vulnerabilities Fixed](https://daily.dev/posts/docker-29-9-0-security-update-five-vulnerabilities-fixed-5i8fr8loi) · Noted · 1 upvotes · 0 comments - [Leaked Kubernetes Secrets: Impact Assessment and Mitigation Strategies](https://daily.dev/posts/leaked-kubernetes-secrets-impact-assessment-and-mitigation-strategies-bs3m8i7md) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#docker](https://daily.dev/tags/docker) [View this post on daily.dev](https://daily.dev/posts/docker-hub-security-advisory-cve-2026-105445-ash3twcdv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Docker Hub Security Advisory: CVE-2026-105445","url":"https://daily.dev/posts/docker-hub-security-advisory-cve-2026-105445-ash3twcdv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/docker-hub-security-advisory-cve-2026-105445-ash3twcdv"},"datePublished":"2026-10-12T16:01:50.031Z","dateModified":"2026-10-12T16:06:08.691Z","description":"Docker disclosed CVE-2026-105445, a Docker Hub flaw where converting a personal account into an organization could re-assign that account's personal access...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Docker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Docker","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8a1022bebfc04a7d824c309bd3686787","url":"https://daily.dev/sources/docker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/docker-hub-security-advisory-cve-2026-105445-ash3twcdv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,docker","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Docker","item":"https://daily.dev/sources/docker"},{"@type":"ListItem","position":3,"name":"Docker Hub Security Advisory: CVE-2026-105445"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/docker-hub-security-advisory-cve-2026-105445-ash3twcdv#faq","mainEntity":[{"@type":"Question","name":"What was CVE-2026-105445 in Docker Hub and what could an attacker do with it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-105445 was a Docker Hub flaw where converting a personal account into an organization re-assigned the converted account's personal access tokens to the newly named owner without rotating the token secret or asking for confirmation. An attacker could create an account, generate a PAT, convert the account naming a target user as owner, and keep using that PAT to pull, push, or delete images under the target's identity and repository access. daily.dev surfaces security advisories like this one for engineers auditing their container registry access."}},{"@type":"Question","name":"How long was the Docker Hub token re-assignment vulnerability active before it was patched?","acceptedAnswer":{"@type":"Answer","text":"The vulnerability existed from August 26, 2024, 20:33 UTC, until a fix was deployed on September 30, 2026, at approximately 19:10 UTC. Docker received the researcher report at 11:40 AM Eastern that same day and deployed the fix to production less than four hours later, around 3:10 PM Eastern. Track how quickly vendors patch supply-chain-relevant CVEs by following security advisories on daily.dev."}},{"@type":"Question","name":"Did Docker find evidence that the Hub account conversion token vulnerability was exploited?","acceptedAnswer":{"@type":"Answer","text":"No evidence of exploitation was found. Docker examined about 304,000 pushes made with transferred tokens and found every one landed in either the converting organization's own repositories or the new owner's own repositories, never an unrelated account; static analysis of the highest-risk public images turned up no malware, cryptominers, or credential harvesting. daily.dev helps developers keep up with incident postmortems when deciding how much to trust a registry."}}]} ```