Docker Hub’s GhostPat Flaw Let One User Push Images as Another — For Two Years

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The company tracked the issue as CVE-2026-105445 and rated it critical, with a CVSS 4.0 score of 9.4 in the CVE record it published on October 13.

How a Personal Account Became Someone Else’s

The flaw sat in the feature that converts a personal account into an organization, Docker explained in a security advisory published October 12. The conversion transferred the account’s personal access tokens (PATs) to the user designated as the organization’s owner. A PAT works in place of a password in the registry, and the person who created each token can keep using it.

While the flaw was open, the conversion changed the owner recorded for each token but left its secret unchanged. An attacker could abuse this by creating a token on an account they controlled, converting that account into an organization, and naming another user as its owner. The token would then work at the registry as that user. The named owner was never asked to confirm the change and was not notified, according to Docker and the researchers who reported the flaw.

The access was limited to the registry. It did not reach the Docker Hub web interface, and it could not be used to change a password, email address, or two-factor settings, or to take over an account. Within the token’s permission level, a transferred token could pull, push, or delete images in the named owner’s repositories and in organizations that owner could access.

Why Docker Rated It Critical

Docker rated the flaw critical because that access “includes publishing images under a legitimate name.” In March and April this year, attackers used stolen publisher credentials to push malicious Trivy and KICS images to the publishers’ own Docker Hub repositories, according to Docker. A GhostPat-style token transfer would have let an attacker do the same without any credential theft at all.

Peter Molnar and Krisztian Hozak of mptrdev.com found the flaw and named it GhostPat. In their technical write-up at ghostpat.com, the two say they reproduced the flaw twice on consenting test accounts. They logged in to the registry as the target account, created and pushed to a repository in its namespace, pushed to an organization it belonged to, and pulled its private repositories.

A Two-Year Window, and a Forensic Sweep

The flaw was open from August 26, 2024 until the fix, a little over two years. Docker deployed the fix less than four hours after receiving the report. Because the fix lived in Docker Hub itself, there was no update to install: Docker reviewed every account conversion made while the flaw was open and compared them with registry logs and token records.

Docker examined every push made with a transferred token, roughly 304,000 in all. Every one of those pushes went to a repository belonging to the converted organization or to its named owner, and in the large majority of cases both accounts belonged to the same person or team. Where Docker could not confirm that, it analyzed the highest-risk public images without running them and found no malware or tampering. Exposed users were notified by email on October 2, and the affected transferred tokens were force-deactivated on October 8.

One caveat matters for forensics: Docker’s registry logs show when a token is used, not that it exists. A transferred token that was never used left no record at all, so Docker treated every token transferred by a conversion during the window as possibly compromised, not just the ones with log activity.

Sources: The Hacker News (Oct 13, 2026); Docker security advisory (Oct 12, 2026); GhostPat technical write-up (mptrdev).

Corrections: Report an error at corrections@wireshaman.com.