Threat reportVulnerabilityTL-2026-3419
Docker Hub personal access token reassignment flaw (CVE-2026-105445, "GhostPAT") enables user impersonation and image tampering
Docker Hub personal access token reassignment flaw (TL-2026-3419), also tracked as GhostPAT, is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-10-13 and last reviewed 2026-10-15. It has no confirmed attribution, affects Docker Docker Hub (IAM personal access tokens, account-to-organization, references 1 CVE (CVE-2026-105445), maps to 13 MITRE ATT&CK techniques (T1036.005, T1078.004, T1098), and is covered by 9 detection rules and 18 indicators of compromise.
- CVSS
- 9.4/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3419
- Threat ID
- TL-2026-3419
- Also known as
- GhostPAT
- Severity
- CRITICAL
- CVSS
- 9.4
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, cloud-services, devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
- Updates
- 2026-10-15 · 3 updates · revalidated 3× · latest source
How Docker Hub personal access token reassignment flaw works
A critical Docker Hub IAM flaw let an attacker create a throwaway account and personal access token (PAT), then convert the account into an organization naming a target user as owner. Docker Hub reassigned the PAT to the target without rotating the secret or asking for consent, so the attacker could authenticate to the registry as the victim and pull, push or delete images. Docker fixed it within hours of the report and found no evidence of exploitation.
CVE-2026-105445 (researcher name: GhostPAT) affected the Docker Hub Identity and Access Management feature that converts a user account into an organization. During conversion, any personal access tokens on the converted account were reassigned to the newly named organization owner. Docker Hub did not rotate or revoke the token secret, did not request confirmation from the named owner, and did not notify them. The vulnerable window ran from 2024-08-26 20:33 UTC, when PAT transfer began, to about 19:10 UTC on 2026-09-30.
The attack chain documented by the reporting researchers (Peter Molnar and Krisztian Hozak, mptrdev.com) has three steps. (1) The attacker creates a throwaway Docker Hub account and mints a PAT with read/write/delete scope. (2) The attacker converts the throwaway account into an organization and names the victim's username as owner/receiver. (3) The PAT, whose secret the attacker still holds, now acts as the victim at the registry level. It authenticates through docker login ("Login Succeeded"), is accepted for bearer exchange at POST /v2/auth/token, and inherits the victim's organization memberships. Within token scope, the attacker could pull private repositories, push or overwrite images under the victim's legitimate names, create repositories and delete images, which is a software supply chain poisoning risk. The attacker-chosen token name could mimic familiar identifiers, so the victim could not easily recognise a rogue token.
Limits: the token did not grant Docker Hub web interface access, and could not change the victim's password, email or 2FA settings or take over the account. Docker reports the report arrived at security@docker.com on 2026-09-30 11:40 EST, the issue was reproduced about 1:30 PM, and a fix was deployed and verified against the PoC about 3:10 PM the same day, which is under four hours after the report. Exposed users and organization owners were emailed on 2026-10-02 (subject "Docker Hub Vulnerability Identified & Resolved"), and all transferred PATs were deactivated on 2026-10-08 unless owners opted to retain them.
Docker analysed about 304,000 pushes made with transferred tokens by correlating registry authentication logs with conversion records and checking for tokens used under multiple identities. All pushes landed in the converted organization's or new owner's own repositories. Static analysis of high-risk public images found no malware, cryptominers, C2, credential harvesting, persistence or tampering. Caveat from Docker: registry logs show token usage, not token existence, so unused transferred tokens leave no trace. No CVSS score, CWE or NVD record was available at the time of research, and no exploitation in the wild is confirmed.
MITRE ATT&CK techniques used in TL-2026-3419
Defense Evasion
Initial Access
T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Persistence
T1098 Account Manipulation; T1136.003 Cloud Account; T1525 Implant Internal Image
Impact
T1485 Data Destruction; T1565.001 Stored Data Manipulation
Credential Access
T1528 Steal Application Access Token
Collection
lateral-movement
Affected products and versions in Docker Hub personal access token reassignment flaw
- Docker — Docker Hub (IAM personal access tokens, account-to-organization conversion)
Vulnerable versions: Service-side: 2024-08-26 20:33 UTC through 2026-09-30 ~19:10 UTC
Fixed in: Fixed in production 2026-09-30 (no customer action needed for the fix); transferred PATs deactivated 2026-10-08
Remediation for Docker Hub personal access token reassignment flaw
Patches
- Fixed server-side by Docker on 2026-09-30: PATs no longer transfer during account-to-organization conversion; user consent and notification now required before being named organization owner; token ownership changes are audit-logged
Immediate actions
- Review Personal Access Tokens in Docker Hub (Account Settings > Personal access tokens) and revoke unrecognized or unused tokens
- If you received the 'Docker Hub Vulnerability Identified & Resolved' email dated 2026-10-02, check the transferred PATs listed by description and creation date
- Audit organization memberships and recent image push/delete history for repositories you own
- Verify image digests of critical images you publish or consume against known-good values
Workarounds
- Transferred PATs were deactivated by Docker on 2026-10-08 (except where owners opted to retain them); contact Docker Support at app.docker.com/support/contact if unsure
Longer-term hardening
- Use organization access tokens instead of personal PATs for CI/CD and automation
- Sign images (e.g. Docker Content Trust / Sigstore) and pin base images by digest
- Rotate and re-issue critical tokens periodically and alert on token creation and ownership changes
- Monitor registry authentication logs for one token used under multiple identities
CVEs associated with Docker Hub personal access token reassignment flaw
Weaknesses (CWE) in Docker Hub personal access token reassignment flaw
Timeline of Docker Hub personal access token reassignment flaw
- Vulnerable behavior introduced at 20:33 UTC: Docker Hub begins reassigning PATs to the named owner during account-to-organization conversion without rotating the secret or obtaining consent
- Researchers Peter Molnar and Krisztian Hozak first reproduce the issue (GhostPAT)
- Independent verification by the researchers and submission to Docker
- Fix deployed to production around 3:10 PM EST (under four hours after the report) and verified against the PoC; PAT transfer removed from conversion flow; researchers notified at 4:59 PM
- Report received at security@docker.com at 11:40 EST; Docker reproduces the flaw internally around 1:30 PM
- Exposed users and organization owners emailed at 5:30 PM EST with subject 'Docker Hub Vulnerability Identified & Resolved', listing transferred PATs by description and creation date
- All transferred PATs deactivated at 3:45 PM EST except those whose owners requested retention
- Docker publishes its advisory and the researchers publish the GhostPAT technical write-up.
- CVE-2026-105445 record published; The Hacker News reports the disclosure.
- BleepingComputer reports on the flaw; Docker states analysis of about 304,000 pushes with transferred tokens found no evidence of exploitation
- SOCRadar publishes analysis of CVE-2026-105445 with CVSS 9.4 and CWE-266 classification and mitigation guidance.
Update history for TL-2026-3419
- 2026-10-15 — CVE-2026-105445: Docker Hub Personal Access Token Reassignment Flaw ("GhostPat", CWE-266): What changed No severity, status or score change (CRITICAL / PATCHED / 9.4 already recorded). CWE-266 (Incorrect Privilege Assignment) added alongside existing CWE-284/639; the newer report attributes the score to CVSS v4.0. New indicators
- 2026-10-13 — Docker Hub 'GhostPat' Flaw (CVE-2026-105445): Personal Access Tokens Transferred on Account-to-Organization Conversion Enable Impersonation: What changed cvss_score null - 9.4 (severity already CRITICAL, exploitability POC_PUBLIC and status PATCHED unchanged). CWE-639 added alongside existing CWE-284. New indicators (2) 2 victim-visible behavioral traces: unrecognized attacker-n
- 2026-10-13 — Critical Docker Hub Flaw (CVE-2026-105445, "GhostPat") Lets Attackers Impersonate Users and Push Container Images: What changed No change to severity (CRITICAL), exploitability (POC_PUBLIC) or status (PATCHED); CVSS still unpublished. Record is enriched only. New indicators (6) 6 behavioral hunting artifacts (conversion naming a different owner, PAT own
Sources cited for Docker Hub personal access token reassignment flaw
- Docker Hub flaw let attackers impersonate users, tamper with images
- Docker Hub Security Advisory: CVE-2026-105445
- GhostPAT technical writeup (Peter Molnar and Krisztian Hozak)
- mptrdev.com (reporting researchers)
- New in Docker Hub: Personal Access Tokens
- NVD CVE API query for CVE-2026-105445 (no record at time of research)
Detection coverage for TL-2026-3419
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3419 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.