GoKawiilDocker Hub bug (CVE-2026-105445) let attackers hijack access tokens of other users
Docker disclosed a critical flaw in Docker Hub where converting a personal account into an organization could reassign that account's personal access token to a named owner without rotating the token or requiring the target's consent. An attacker could exploit this to authenticate as the target user, gaining the ability to pull, push, or delete images in their repositories, depending on the token's scope and permissions. The bug has existed since August 26, 2024, though it did not grant web access or allow changes to passwords, email, or two-factor settings.