# Docker Hub personal access token reassignment flaw (CVE-2026-105445, "GhostPAT") enables user impersonation and image tampering

> A critical Docker Hub IAM flaw let an attacker create a throwaway account and personal access token (PAT), then convert the account into an organization naming a target user as owner. Docker Hub reassigned the PAT to the target without rotating the secret or asking for consent, so the attacker could authenticate to the registry as the victim and pull, push or delete images. Docker fixed it within hours of the report and found no evidence of exploitation.

- **Published:** 2026-10-13T15:41:43Z
- **Last reviewed:** 2026-10-15T13:21:54.300Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3419
- **ID:** TL-2026-3419
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-105445

## Description

CVE-2026-105445 (researcher name: GhostPAT) affected the Docker Hub Identity and Access Management feature that converts a user account into an organization. During conversion, any personal access tokens on the converted account were reassigned to the newly named organization owner. Docker Hub did not rotate or revoke the token secret, did not request confirmation from the named owner, and did not notify them. The vulnerable window ran from 2024-08-26 20:33 UTC, when PAT transfer began, to about 19:10 UTC on 2026-09-30.

The attack chain documented by the reporting researchers (Peter Molnar and Krisztian Hozak, mptrdev.com) has three steps. (1) The attacker creates a throwaway Docker Hub account and mints a PAT with read/write/delete scope. (2) The attacker converts the throwaway account into an organization and names the victim's username as owner/receiver. (3) The PAT, whose secret the attacker still holds, now acts as the victim at the registry level. It authenticates through docker login ("Login Succeeded"), is accepted for bearer exchange at POST /v2/auth/token, and inherits the victim's organization memberships. Within token scope, the attacker could pull private repositories, push or overwrite images under the victim's legitimate names, create repositories and delete images, which is a software supply chain poisoning risk. The attacker-chosen token name could mimic familiar identifiers, so the victim could not easily recognise a rogue token.

Limits: the token did not grant Docker Hub web interface access, and could not change the victim's password, email or 2FA settings or take over the account. Docker reports the report arrived at security@docker.com on 2026-09-30 11:40 EST, the issue was reproduced about 1:30 PM, and a fix was deployed and verified against the PoC about 3:10 PM the same day, which is under four hours after the report. Exposed users and organization owners were emailed on 2026-10-02 (subject "Docker Hub Vulnerability Identified & Resolved"), and all transferred PATs were deactivated on 2026-10-08 unless owners opted to retain them.

Docker analysed about 304,000 pushes made with transferred tokens by correlating registry authentication logs with conversion records and checking for tokens used under multiple identities. All pushes landed in the converted organization's or new owner's own repositories. Static analysis of high-risk public images found no malware, cryptominers, C2, credential harvesting, persistence or tampering. Caveat from Docker: registry logs show token usage, not token existence, so unused transferred tokens leave no trace. No CVSS score, CWE or NVD record was available at the time of research, and no exploitation in the wild is confirmed.

## MITRE ATT&CK

- T1136.003 Cloud Account
- T1098 Account Manipulation
- T1078.004 Cloud Accounts
- T1195.002 Compromise Software Supply Chain
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1530 Data from Cloud Storage
- T1565.001 Stored Data Manipulation
- T1485 Data Destruction
- T1190 Exploit Public-Facing Application
- T1525 Implant Internal Image
- T1199 Trusted Relationship
- T1036.005 Masquerading

## Sources

- [Docker Hub flaw let attackers impersonate users, tamper with images](https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/)
- [Docker Hub Security Advisory: CVE-2026-105445](https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/)
- [GhostPAT technical writeup (Peter Molnar and Krisztian Hozak)](https://ghostpat.com/)
- [mptrdev.com (reporting researchers)](https://mptrdev.com/)
- [New in Docker Hub: Personal Access Tokens](https://www.docker.com/blog/docker-hub-new-personal-access-tokens/)
- [NVD CVE API query for CVE-2026-105445 (no record at time of research)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-105445)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3419