Infrastructure

Docker Hub Vulnerability Allows PAT Transfer During Account Conversions

A vulnerability in Docker Hub's identity and access management system allowed unintended transfer of personal access tokens during account-to-organization conversions, prompting updates and deactivation of affected tokens.

AI-generated editorial illustration of the article topic; not a photograph, product screenshot or measured result.

Discovery and Initial Response

On September 30, 2026, security researchers identified a vulnerability in Docker Hub’s identity and access management system through the company’s Vulnerability Disclosure Program. The issue involved the unintended transfer of personal access tokens (PATs) during account-to-organization conversions. According to the advisory posted on October 12, 2026, by Mark Lechner, the report was received by Docker’s security team at 11:40 AM on September 30. In response, Docker updated its documentation by approximately 3:23 PM on the same day, clarifying that PATs do not transfer during such conversions and must be recreated by the new owner. The advisory recommends using organization access tokens instead for improved security. The incident highlights the importance of continuous monitoring and rapid response in managing access control systems.

Nature of the Vulnerability

Docker Hub allows users to convert a personal account into an organization, a process necessary for managing repositories without disrupting existing Docker pulls. However, beginning August 26, 2024, this conversion process also re-assigned the personal access tokens (PATs) associated with the converted account to the new organization owner. This change introduces a security risk, as PATs—often used for authentication and access control—may now be transferred without explicit user consent or awareness. The vulnerability arises from the lack of clear user notification and the potential for unintended access to repositories and other resources. This issue highlights the importance of careful token management and the need for Docker Hub to provide more transparent controls during account conversions.

Mitigation and Remediation Efforts

Docker Hub has taken steps to mitigate the security risk associated with personal access tokens (PATs) being transferred during account-to-organization conversions. As of October 8, all PATs transferred through this process have been forcibly deactivated, except in cases where the account holder opted out of this action. Docker Hub emphasizes that if you did not receive an email related to this deactivation, it indicates that no PAT on your account was transferred through this flow. To further secure your account, users are advised to review their personal access tokens under the Account settings section on Docker Hub. Any tokens that are not recognized or no longer needed should be revoked immediately. This action is part of Docker Hub’s ongoing efforts to enhance account security and protect user credentials from unauthorized access.

Impact and Scope of the Vulnerability

The Docker Hub security advisory highlights a vulnerability related to the transfer of personal access tokens during account-to-organization conversions. According to the investigation, every account conversion since August 26, 2024, was reviewed and correlated with registry authentication logs, Docker Hub usage data, and IAM token records. On October 2, all affected users and organization owners were notified. The vulnerability did not grant access to the Docker Hub web interface, nor could it be used to change passwords, email addresses, two-factor settings, or take over accounts. The scope of the issue is limited to the exposure of personal access tokens during specific account conversion processes. Docker Hub has taken steps to inform impacted parties, but users are advised to review their security practices and consider rotating tokens as a precautionary measure.

Recommendations and Preventive Measures

Docker Hub has issued a security advisory regarding the potential exposure of personal access tokens (PATs) during account-to-organization conversions. To mitigate this risk, users are advised to use organization access tokens for automation tasks that belong to an organization, rather than relying on individual PATs (Docker). Additionally, if a security vulnerability is discovered in any Docker product, it should be reported directly to security@docker.com (Docker). Deanna Sparks, a Docker security representative, emphasized the importance of these measures in a recent statement (Docker). Users are encouraged to review their token usage and ensure that all automation processes are configured with the appropriate level of access to prevent unintended exposure of sensitive credentials.