Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions
Docker Hub identified a vulnerability where personal access tokens were incorrectly re-assigned during account-to-organization conversions. The issue has been addressed to prevent unauthorized token ownership transfer.
Verified State Diff
Impact & Verification Analysis
Docker Hub users who converted personal accounts to organization accounts.
This vulnerability represents a significant security risk regarding identity and access management (IAM) and the integrity of automated CI/CD pipelines that rely on these tokens.
Full Fact Overview
CVE-2026-105445 describes a flaw in the Docker Hub account management logic where the conversion process from a personal account to an organization account failed to properly invalidate or isolate existing personal access tokens. This resulted in tokens remaining active under the new organizational ownership structure, potentially granting unauthorized access to resources. Docker has implemented a fix to ensure that token ownership is correctly handled and restricted during account migration workflows.