Docker Hub flaw let converted accounts hand over active access tokens

How the vulnerability worked

Docker Hub allows users to convert a personal account into an organization. Docker explains that people use this because Hub has no way to move a repository from one account to another. Conversion lets a repository such as alice/app become organization-owned without breaking the Docker pulls that reference it.

During conversion, the user names an existing Docker Hub account as the new organization's owner. Beginning August 26, 2024, conversion also re-assigned the converted account's personal access tokens (PATs) to that new owner. According to Docker, it did this by changing the token's owner record, without rotating or revoking the token secret. The named owner was not asked to confirm and was not notified.

That made the following attack possible:

• An attacker creates an account and generates a PAT on it.
• The attacker converts the account to an organization and names a target user as the owner.
• The PAT is re-assigned to the target, but the attacker still holds the secret and the token stays active.
• The token then authenticates to the registry as the target user.

Impact and timeline

Within the scope of the token, an attacker could potentially pull, push and delete images in the target's repositories and in organizations where the target had access. Because that includes publishing images under a legitimate name, Docker treated the issue as a software supply chain risk and rated it critical.

Docker says the flaw did not give access to the Docker Hub web interface. It also could not be used to change the target's password, email address or two-factor settings, or to take over the account.

The exposure window ran from August 26, 2024, 20:33 UTC, until the fix was deployed on September 30, 2026. Security researchers reported the issue through Docker's Vulnerability Disclosure Program that day. Docker reports receiving the report at 11:40 AM U.S. Eastern, reproducing it at about 1:30 PM and deploying a fix at about 3:10 PM, less than four hours after receipt. Conversion no longer transfers PATs, and the documentation was updated to say that the new owner must recreate them, with organization access tokens recommended.

On October 2, Docker emailed the users whose accounts received transferred PATs and notified the associated organization owners. On October 8, it deactivated the identified transferred PATs, except where account holders opted out.

What Docker found

Docker says it enumerated every account conversion since August 26, 2024 and correlated them with registry authentication logs, Docker Hub usage data and IAM token records. It looked for any token used under more than one identity and examined every push made with a transferred token, about 304,000 in all.

According to Docker, every one of those pushes landed either in the converted organization's own repositories or in the new owner's own repositories, and none went into an unrelated user's or organization's account. In most cases, the converted account and the named owner belonged to the same person or team, which is the intended use of the feature. Docker also statically analyzed the highest-risk public images, without executing them, and found no malware, cryptominers, command-and-control activity, credential harvesting, persistence or tampering. It found no evidence that its own infrastructure or services were affected.

Docker acknowledges a limit to this finding: registry logs show when a token is used, not that it exists, so a transferred token that was never used leaves no trace. For that reason, it treated every PAT that moved through conversion during the window as potentially affected.

Changes and what users should do

The immediate fix removed PAT transfer from conversion entirely. Docker says it is also requiring consent from a user before they are named as an organization owner and notifying them when it happens. It is recording an auditable history of every token ownership change and reviewing other flows that change credential ownership for the same pattern.

Users who did not receive the October 2 email with the subject line "Docker Hub Vulnerability Identified & Resolved" were not exposed, and Docker says they need to take no action. Docker still advises everyone to review the personal access tokens under Account settings, Personal access tokens in Docker Hub, and to revoke any they do not recognize or no longer use. For automation that belongs to an organization, it recommends organization access tokens rather than a person's PAT.

Docker credited Peter Molnar and Krisztian Hozak of mptrdev.com for finding and responsibly reporting the issue. Their technical write-up is available at ghostpat.com.