Vulnerability details
CVE-2026-105445
Docker Hub
Docker Hub account conversion could reassign an active personal access token to another user
CVSS 4.0
9.4Critical
Official description
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (Docker) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Docker | Docker Hub | 2024-08-26T20:33:00Z ≤ v < 2026-09-30T19:10:00Z | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/ vendor-advisory
- https://docs.docker.com/accounts/organization/setup/convert-account/ product
- https://ghostpat.com/ third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-13
- Last updated
- 2026-10-19
- State
- Published
- Assigner (CNA)
- Docker
- Kolun priority
- 34 · Low
Exploit prediction (EPSS)
0.43%
Probability of exploitation in 30 days
37.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-266Incorrect Privilege Assignment