Discover how a multi-year account conversion flaw in Docker Hub, tracked as CVE-2026-105445 and named GhostPat, permitted unauthorized cross-account repository access via transferred personal access tokens.
Learn the technical scope, timeline, and mitigation details.
The problem remained open for more than two years, from August 26, 2024 to September 30, 2026. It was discovered by researchers Peter Molnar and Krisztian Hozak, who named it GhostPat.
How did the problem work?
The glitch involved the feature that converts a personal account to an organization. When this change was made, personal digital access keys were transferred to the user who was designated as the organization owner.
This way, someone could create an account, convert it to an organization, and designate someone else as the owner. The key would still work, and they could upload, download, or delete image files as if they belonged to the unsuspecting user.
The investigation and the company's response
Docker rated the issue critical and fixed it on September 30, 2026. The company reviewed approximately 304.000 upload actions and found no evidence that the issue was exploited in practice.
On October 2, 2026, the company sent emails to affected users and, on October 8, 2026, deactivated the transferred keys. The platform now requires consent and sends notifications when an owner is assigned to an organization.
Top comments (0)