Read the docs
TI-2026-71946 Aliases CVE-2026-105445GHSA-phq5-vq2m-8rp9

Incorrect privilege assignment in Docker Hub account conversion

Priority MEDIUM 43CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

Docker Hub is affected from 2024-08-26T20:33:00Z before 2026-09-30T19:10:00Z. An incorrect privilege assignment (CWE-266) in the account-to-organization conversion feature lets a personal access token be reassigned to another user without rotating or revoking its secret. An authenticated attacker can reassign a token they control, and the unchanged token then authenticates to the registry as the recipient with its scopes, including organization repositories.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix Fixed Docker Hub (Docker): 2026-09-30T19:10:00Z

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DockerDocker Hub2024-08-26T20:33:00Z to before 2026-09-30T19:10:00Z2026-09-30T19:10:00ZPatch availableCNA
  • Docker Hub VendorDocker Affected 2024-08-26T20:33:00Z to before 2026-09-30T19:10:00Z Fixed in 2026-09-30T19:10:00Z Patch available CNA

Remediation

Docker Hub is fixed as of 2026-09-30.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA Docker Hub (Docker) Fixed in 2026-09-30T19:10:00Z

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-105445
  2. 2026-10-13 Alias added: GHSA-phq5-vq2m-8rp9
  3. 2026-10-19 CISA SSVC decision points changed

References

Advisory 2

Other 1

  • TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2025-08316 Docker Desktop allows unauthenticated access to Docker Engine API from containers CVSS 4.0CRITICAL 9.3
  • TI-2025-02823 Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion CVSS 4.0HIGH 7.3
  • TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
  • TI-2023-21271 Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to… CVSS 3.1MEDIUM 6.5
See all 132 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences