Docker Hub GhostPat flaw let account conversion hand access tokens to any victim
CVE-2026-105445 (CVSS 9.4): for two years, converting a Docker Hub account into an organization re-assigned its personal access tokens to whoever was named owner, without consent. An attacker could mint a token, convert, name a victim, and push to the victim's repositories. Docker found no exploitation.
Docker published an advisory on October 12 for CVE-2026-105445, nicknamed GhostPat (CVSS 4.0 score 9.4), a Docker Hub flaw open from August 26, 2024 until a fix on September 30, 2026. When a personal account was converted into an organization, its personal access tokens (PATs) were transferred to the user named as the organization's owner: the recorded owner changed, the token secret did not, and the named owner was neither asked nor told. An attacker could create a token on an account they controlled, convert it, name a victim as owner, and use the same token against the registry as the victim. Access stopped at the registry, with no web login or account changes. Docker reviewed about 304,000 pushes made with transferred tokens, found no evidence of exploitation, and deactivated transferred tokens on October 8. Peter Molnar and Krisztian Hozak reported it.
Why it matters
A bearer token is whoever the server's database says it belongs to. GhostPat changed that record without changing the secret, so a credential the attacker already held quietly became the victim's. Ownership transfer is an identity event and needs the same consent and notification as a password change.
Docker now requires consent before naming an owner, notifies the user, and logs ownership changes. If Docker did not email you on October 2, you were not exposed. Otherwise, review and revoke unrecognized PATs, check the account switcher for organizations you never joined, and review push activity in organization logs. For CI, use organization access tokens rather than a person's PAT, and sign images so a push alone cannot ship code. For your own SaaS, test what happens to tokens on account merges, conversions and transfers; that path is easy to miss in reviews.
Source: Docker
Related on Start with Identity
- BlogCrowdSec kept a departing engineer's GitHub access open, and lost 170 private repositories through it
An engineer's laptop was infected in the May TanStack npm attack. Eleven days later his still-active GitHub OAuth token was used to copy about 170 of CrowdSec's
- BlogA hijacked AI coding assistant session spread Shai-Hulud to about 100 internal repositories
Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stol
- BlogGhostAction phish completes a GitHub device flow, then hides a stealer in a font file
OpenSourceMalware found a fake GitHub security alert that proxied a maintainer's password and 2FA code, then silently completed an OAuth device flow for repo, w
- CVESailPoint IdentityIQ role-editing authorization flaw
IdentityIQ failed to authorize role edits on all versions at disclosure (April 2026). Anyone who could reach the role-editing surface could change roles they sh
- CVEKeycloak authorization bypass
Keycloak failed an authorization check, so a caller could reach a resource their role should have blocked. Part of the April 2024 RHSA-2024:1868 set with CVE-20
- CVEKeycloak UMA policy privilege escalation
Keycloak's UMA policy engine checked only the first resource in a request (CWE-266). Additional resources skipped the check. A privilege escalation in user-mana