CVE-2026-105445: CWE-266: Incorrect Privilege Assignment in Docker Docker Hub

This vulnerability involves incorrect privilege assignment (CWE-266) in Docker Hub's account-to-organization conversion process. An authenticated attacker can reassign a personal access token (PAT) they control to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticates to the registry as the recipient user, allowing the attacker to perform registry operations permitted by the token's scope on repositories accessible to that user, including organization repositories. The CVSS 4.0 score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

An attacker with authentication can reassign a personal access token to another user without token rotation, enabling unauthorized registry access as the recipient user. This allows the attacker to pull, push, or delete container images within the token's scope, potentially affecting organization repositories and leading to significant confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Docker's official advisories for updates. Until a fix is available, consider restricting access to the account-to-organization conversion feature and reviewing personal access token usage and permissions carefully.