Is CVE-2026-105445 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105445 being exploited in the wild.

How severe is CVE-2026-105445?

Informational severity, published 13 October 2026.

How is CVE-2026-105445 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105445?

Check whether you run Docker Hub. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105445: Docker Hub privilege escalation in account-to-organization conversion

CVE-2026-105445 · Severity: info · Published 2026-10-13

Docker Hub allows users to convert personal accounts into organizations. An authentication vulnerability in this conversion process allowed an attacker to transfer their personal access tokens to any other user's account without notification or consent. The victim's account would then have the attacker's tokens active, granting full read, write, and delete access to images and repositories within that victim's scope, creating a supply-chain security risk across the container registry.

Vendors: Docker.

Quick answers

Is CVE-2026-105445 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105445 being exploited in the wild.
How severe is CVE-2026-105445?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Docker Docker Hub.
Is there a fix for CVE-2026-105445?: Yes: fixed in Fixed 2026-09-30. Until then: Review your Personal Access Tokens immediately by visiting Account Settings → Personal Access Tokens and revoke all tokens you do not actively require, then re-issue new ones. Check your Organizations list in the account switcher for any unrecognized organizations. Docker force-deactivated transferred tokens on 2026-10-08 unless the account holder opted out. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105445 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105445?: Check whether you run Docker Hub. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fixed 2026-09-30

Review your Personal Access Tokens immediately by visiting Account Settings → Personal Access Tokens and revoke all tokens you do not actively require, then re-issue new ones. Check your Organizations list in the account switcher for any unrecognized organizations. Docker force-deactivated transferred tokens on 2026-10-08 unless the account holder opted out.

Technical details

An incorrect privilege assignment in Docker Hub's account-to-organization conversion feature failed to validate that the receiver (destination user) had consented to the conversion and failed to revoke or restrict the sender's personal access tokens. An authenticated attacker could convert a throwaway account to an organization, designate any existing user as receiver, and the sender's PAT would be silently transferred with full scope intact, authenticating as the recipient user and inheriting their organization memberships. The attacker required only a free Docker account and basic UI access; no additional technical exploit was needed.

Affected products

Docker Docker Hub

Timeline

2026-09-28: disclosed
2026-09-29: exploited: Second independent reproduction and full impact testing
2026-09-30: patched: Fix deployed approximately 3 hours and 30 minutes after report received
2026-10-02: advisory: Exposed users notified by email
2026-10-08: other: Transferred tokens force-deactivated (opt-out applies)
2026-10-13: other: CVE-2026-105445 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.