What happened

Docker disclosed a vulnerability in Docker Hub. When a personal account was converted into an organization, its personal access tokens were reassigned to the person named as the new owner. The token secret was not changed, and that person was not asked to consent or notified.

An attacker could create a token, convert their own account, and name a target as owner. The token could then act as the target at the registry, pulling, pushing or deleting images in the target's repositories. Docker rated the flaw critical, with a CVSS 4.0 score of 9.4.

Access was limited to the registry. According to Docker, it did not reach the web interface or allow changes to passwords, email or two-factor settings, or account takeover.

Researchers reported the flaw on September 30, 2026, and Docker deployed a fix to Docker Hub the same day. Docker says it reviewed about 304,000 pushes made with transferred tokens and found no evidence of exploitation. This was a vulnerability, not a breach of Docker's systems.

Docker emailed affected users and organization owners on October 2 and deactivated the identified transferred tokens on October 8, except where owners asked to keep them. Conversion no longer transfers tokens, and naming an organization owner now requires consent. Nothing needs to be installed.

Timeline

  1. Exposure window begins: account conversion starts re-assigning personal access tokens to the new owner.[1]

  2. Researchers report the flaw to Docker, and Docker deploys a fix to production the same day.[1]

  3. Docker emails exposed users and their organization owners.[1]

  4. Docker deactivates the identified transferred tokens, except where owners opted to keep them.[1]

  5. Docker publishes its security advisory.[2]

  6. The CVE record is published.[2]

Who is affected

  • Users whose accounts received a transferred token through an account conversion, and the related organization owners. Docker emailed them.
  • Docker says users who didn't get its email never had a token transferred, so they need to do nothing.
  • Docker notes a transferred token could have been exposed whether or not it was ever used.

How to check

  1. Look for Docker's notification email from October 2.
  2. In Docker Hub, open Account settings and Personal access tokens, and look for any token you did not create or no longer use.
  3. Check whether your account switcher shows an organization you don't remember joining.
  4. Organization owners can review past pushes in activity logs, which show the token used. Docker Home keeps them for 30 days.

What to do

  1. Revoke personal access tokens you don't recognize or no longer use.
  2. Use organization access tokens, not one person's personal access token, for organization automation.
  3. If you got no email from Docker, Docker says no action is needed.
  4. Contact Docker Support with questions about the notice.

Sources

Changelog

  1. First published.