Docker has fixed a critical Docker Hub flaw, tracked as CVE-2026-105445 and nicknamed GhostPat, that let an attacker use a token to act as another account at the registry level. Docker found no evidence of exploitation after reviewing all account conversions and about 304,000 pushes made with transferred tokens.
GhostPat Let an Attacker’s Token Become the Victim’s Token
The flaw sat in how Docker Hub converts a personal account into an organization. During conversion, the account’s personal access tokens were reassigned to the designated owner without changing the secret and without asking that owner’s consent.
An attacker could therefore create an account and a personal access token, convert the account into an organization and name a victim as owner. The attacker’s token then acted as the victim at registry level, with the ability to pull, push or delete images in the victim’s repositories and organizations.
CVSS 9.4 With Limits on the Damage
CVE-2026-105445 is rated critical, with a CVSS 4.0 score of 9.4. The access was limited to the registry. It did not allow web UI access, changes to passwords, email or two-factor authentication, or account takeover.
Open for Just Over Two Years
The flaw was open from August 26, 2024 until the fix, a period of just over two years. Peter Molnar and Krisztian Hozak of mptrdev.com found it and named it GhostPat. Docker fixed it in under four hours after receiving their report.
Docker’s Review Found No Evidence of Abuse
Docker reviewed all account conversions and about 304,000 pushes made with transferred tokens and found no evidence of exploitation. It also analyzed high-risk public images without running them and found no malware or tampering.
The company treated every transferred token as possibly affected because its logs show when a token is used, not whether it exists. The advisory does not report results for pulls or deletions. Docker emailed affected users on October 2.
The scope of the review matters. Docker checked every account conversion on record, not a sample, and examined roughly 304,000 pushes made with transferred tokens. Its image analysis was static, meaning Docker never ran the high-risk public images it examined, and it found neither malware nor tampering.
Docker Deployed the Fix on September 30
Docker deployed the fix on September 30. Because Docker Hub is a hosted service, customers do not need to install an update. Users who want to be careful can rotate their tokens.
Supply-Chain Context From Earlier 2026 Incidents
Docker pointed to earlier 2026 incidents as context for why the flaw matters. In those cases, stolen publisher credentials were used to push malicious Trivy and KICS images. GhostPat would have offered a different route to the same outcome: publishing images under legitimate names without stealing the publisher’s password.
Pull, Push and Delete Rights Under the Victim’s Identity
Registry-level access to a victim’s repositories covers pushing new images, pulling existing ones and deleting them. Docker analyzed high-risk public images for tampering as part of its review, and it did so without running them.
The CVE record also carries two different dates in the reporting: the advisory is dated October 12 and the CVE record October 13, with the fix deployed on September 30. The advisory leaves some questions unanswered. Docker’s evidence that no one abused the flaw rests on conversion records and push logs, and the company says those logs cannot show whether a token existed without being used. For pulls and deletions, the advisory reports no results. Docker’s decision to email affected users on October 2, ten days before the public advisory, gave those users time to rotate tokens before the details became public.
