Docker disclosed a critical Docker Hub identity flaw (CVE-2026-105445), dubbed GhostPAT by researchers Peter Molnar and Krisztian Hozak of mptrdev.com, live from 26 August 2024 until a fix was deployed on 30 September 2026. Because Docker Hub offers no way to move a repository between accounts, converting a personal account to an organisation re-assigned the converted account's personal access tokens to the new owner — changing the token's owner record without rotating or revoking the secret, and without asking or notifying the named owner. An attacker could therefore create a PAT, convert its account to an organisation naming a target user as owner, and keep authenticating to the registry as the victim to pull, push or delete images in the target's repositories and organisations — a supply-chain risk Docker rated critical. Docker fixed the flaw within four hours of the report, reviewed about 304,000 pushes made with transferred tokens and found no evidence of exploitation, forcibly deactivated transferred PATs on 8 October, and now requires owner consent and notification plus an auditable token-ownership history. Australian container estates should rotate any PAT tied to account-to-organisation conversions and prefer organisation access tokens for automation.

• Source article