---
title: Docker Hub 'GhostPAT' (CVE-2026-105445): account-to-org conversion handed an attacker's token to the named owner | ctxsec
url: https://ctxsec.com/items/docker-hub-ghostpat-cve-2026-105445
description: ""
status: "confirmed (vendor); no evidence of exploitation"
published: 2026-10-12
---

> 

[← Cybersecurity News](/news) · [markdown](/items/docker-hub-ghostpat-cve-2026-105445.md)

confirmed (vendor); no evidence of exploitation

2026-10-12

### Docker Hub 'GhostPAT' (CVE-2026-105445): account-to-org conversion handed an attacker's token to the named owner

Docker disclosed a critical Docker Hub identity flaw, reported Sept 30 by Peter Molnar and Krisztian Hozak and fixed server-side the same afternoon. From Aug 26, 2024, converting a personal account into an organization re-assigned the account's personal access tokens to whoever was named as the new owner, without rotating the secret or asking that owner. An attacker could create an account and PAT, convert it naming a target as owner, and keep using the PAT to pull, push or delete images as the target within the token's scopes, a software supply-chain risk. It could not reach the web UI or take over the account. Docker reviewed about 304,000 pushes made with transferred tokens and found no evidence of exploitation, notified exposed users Oct 2, and force-deactivated transferred PATs Oct 8. No client update is needed.

Sources: [Docker security advisory](https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/) · [CVE-2026-105445](https://www.cve.org/CVERecord?id=CVE-2026-105445)