Dark Web Intelligence (@DailyDarkWeb) on X

What it is

CVE-2026-105445 is a Docker Hub flaw that let an attacker's personal access token (PAT) act as another user at the registry level. This write-up is a secondary social post (@DailyDarkWeb) summarizing Docker's Oct 12, 2026 advisory. The research is linked at ghostpat.com. The advisory itself was not fetched, so Docker's own wording and any extra detail should be checked there.

How it works

Converting a personal account into an organization re-assigned that account's PATs to whoever was named as the new owner. The secret was not rotated and the named owner was not asked. An attacker could therefore create an account, mint a PAT, convert the account to an organization naming a target as owner, and keep using the token as that target. The token could pull, push or delete images in any repo the target could reach.

Preconditions / Affected

• Exposure window: Aug 26, 2024 to Sept 30, 2026. Docker reportedly deployed a fix the same afternoon it was reported (Sept 30).
• Impact was registry impersonation only. The post says there was no web UI access and no password, email or 2FA changes.
• The post rates the main risk as publishing images under a trusted name, i.e. supply chain.

What to do

• Docker emailed affected users on Oct 2. Check for that email.
• Transferred PATs were deactivated Oct 8, except where owners opted out. If you opted out, those tokens may still be live, so review them yourself.
• Review all Docker Hub PATs and revoke any you don't recognize.
• Use organization access tokens for org automation rather than personal PATs.
• If you publish images that others trust, check your repos' push and delete history from the exposure window.

Caveats

• Docker reviewed about 304,000 pushes made with transferred tokens and found no evidence of exploitation. The post does not say whether pulls or deletes were covered by that review.
• The "critical" rating and the supply-chain framing come from the post's analyst note, which says Docker rated it critical.