Docker has published a security advisory covering CVE-2026-105445, a flaw in Docker Hub's account-to-organization conversion flow. According to the advisory, converting an account into an organization could re-assign personal access tokens (PATs) to a new owner. Docker's post explains what happened, who was affected, and how the issue was fixed.
The concrete points from the advisory:
- CVE-2026-105445 covers the Docker Hub account conversion process, where tokens created under a user account could end up owned by a different principal after the conversion.
- The issue applies specifically to personal access tokens, the long-lived credentials developers use for
docker loginin CI/CD pipelines and automation. - Docker documents the affected scope and the conditions under which a token could be re-assigned during conversion.
- A fix has been applied to the conversion handling to prevent token ownership from being transferred unintentionally.
- The advisory directs users to the Docker Hub security notice for details on what happened, who was affected, and remediation steps.
For developers, PATs are effectively passwords for registry access: they authorize image pulls and pushes in build agents, deployment jobs and local setups. If a token silently changes hands, the practical risk is that credentials intended for one owner keep working under another, which complicates audit trails and least-privilege assumptions. Teams running account-to-organization migrations should review the advisory, check whether their tokens were created before or during a conversion, and rotate any PATs used in automation as a precaution.
The broader takeaway is that token lifecycle events are part of the attack surface of a registry. Treat PAT scopes as narrowly as possible, store them in a secrets manager rather than plain environment variables, and prefer short-lived or scoped credentials where your tooling supports it. Verify that ownership metadata in Docker Hub matches the team that actually runs the pipeline.
Source: https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/