{"id":"CVE-2026-105445","published":"2026-10-13T18:17:13Z","modified":"2026-10-19T13:16:53Z","title":"An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an…","vendor":"Docker","product":"Docker Hub","tier":"core","eol":null,"description":{"text":"An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.","provenance":"source","from":"NVD"},"summary":{"text":"An Incorrect Privilege Assignment flaw in Docker Hub's account-to-organization conversion feature lets an attacker reassign a personal access token they control to another Docker Hub user without rotating or revoking the token secret. The attacker needs to be authenticated to Docker Hub, and the unchanged token then authenticates to the registry as the recipient, able to pull, push, or delete images within its scopes in repositories that user can access, including organization repositories.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:19:27Z"},"cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","provenance":"source","from":"NVD"},"epss":{"score":0.0043,"percentile":0.37233,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 22, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad8d340ce8bef7ffa79b89b","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad7813c340f998d3db4d0bb","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad62f708ed98220bccde9c8","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad4ddae89608f8a66f58915","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad38c2e0aa0d5de6ee8bb52","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad23ab69d40bd72818ecdae","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ad0e93a078e6220a69919cf","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6acf987fa92372976a324f03","created":"2026-10-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-266","name":"Incorrect Privilege Assignment"}],"references":[{"url":"https://docs.docker.com/accounts/organization/setup/convert-account/","tags":[]},{"url":"https://ghostpat.com/","tags":[]},{"url":"https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-98965","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98965","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-10-23","earliestUrl":"https://github.com/CompleteTech-Security/docker-hub-ghostpat-check","repos":[{"name":"CompleteTech-Security/docker-hub-ghostpat-check","url":"https://github.com/CompleteTech-Security/docker-hub-ghostpat-check","stars":0,"created":"2026-10-23"}]},"first":{"date":"2026-10-23","source":"PoC-in-GitHub","url":"https://github.com/CompleteTech-Security/docker-hub-ghostpat-check"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105445","provenance":"source"},{"date":"2026-10-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/CompleteTech-Security/docker-hub-ghostpat-check","provenance":"source"}],"speed":{"daysToPublicExploit":10,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":21.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":7.45,"detail":"percentile 0.3723"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.58,"detail":"base score 9.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}