Critical Docker Hub Vulnerability Lets Attackers Impersonate Users and Tamper With Container Images

Docker disclosed a critical vulnerability in Docker Hub that let attackers impersonate other users at the container registry level.

This flaw, tracked as CVE-2026-105445 and dubbed GhostPat, exploited how Docker handled personal access tokens during account conversions.

Depending on token permissions, it could enable unauthorized image downloads, malicious image uploads, and repository image deletions.

Docker Hub Vulnerability

Researchers Peter Molnar and Krisztian Hozak from mptrdev.com reported the issue on September 30, 2026. Docker deployed a production fix less than four hours later and publicly disclosed the vulnerability on October 12.

The exposure window lasted from August 26, 2024, until September 30, 2026, meaning the defective conversion behavior was active for more than two years.

The vulnerability stemmed from Docker Hub’s mechanism for converting personal accounts into organizations while preserving existing repository names.

During this conversion, users would designate an existing Docker Hub account as the organization’s owner. However, the process also reassigned the original account’s personal access tokens to that owner without rotating or revoking their underlying secrets.

An attacker could create a disposable account, generate a personal access token (PAT), and convert the account into an organization while designating a victim as its owner.

Since Docker did not require the recipient’s approval or notify them, the attacker retained a working token that authenticated as the victim. Researchers demonstrated access to the victim’s private repositories and image uploads within both the victim’s namespace and any organization they could access.

The access granted remained limited by token permissions and the target’s repository privileges. Nonetheless, publishing modified images under trusted namespaces posed a significant software supply chain risk.

Docker emphasized that the flaw did not grant access to its web interface, allow changes to passwords, email addresses, or two-factor authentication settings, nor enable full account takeover.

Docker investigated every account conversion during the exposure window by correlating registry authentication logs, usage data, and identity records.

Investigators reviewed approximately 304,000 image pushes involving transferred tokens and found no evidence of exploitation. Each push targeted either the converted organization’s repositories or the new owner’s repositories, rather than unrelated accounts.

Static analysis of the highest-risk public images revealed no malware, cryptominers, credential harvesting, persistence, command-and-control activity, or tampering.

However, Docker cautioned that unused transferred tokens would not appear in registry authentication logs; therefore, potentially affected credentials were identified through conversion history rather than observed activity.

Affected users and organization owners were notified on October 2. Docker deactivated the transferred PATs on October 8, except where owners explicitly opted out.

The fix eliminates token transfers during conversion. Additionally, Docker is introducing ownership consent, notifications, and auditable token ownership histories.

Users should review unfamiliar PATs, revoke unnecessary credentials, and use organization access tokens for organizational automation. Docker stated that users who received no notification were not exposed to this vulnerability.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.