Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

Docker Hub contained a critical vulnerability (GhostPat, CVE-2026-105445, CVSS 9.4) in the account-to-organization conversion flow that could transfer personal access tokens to a named organization owner without their consent, allowing an attacker to push, pull, or delete images in the registry as the victim and potentially publish images under a legitimate name; Docker fixed the flaw, reviewed conversion activity and about 304,000 pushes, reported no evidence of exploitation, notified and deactivated identified transferred tokens, and advised users to rotate tokens and use organization access tokens for automation.