Date: October 13, 2026 | Author: Threat Research & Intelligence Team, Digital Spying
Category: Cloud Security / Container Security / Supply Chain Vulnerabilities / Identity and Access Management / DevSecOps
Tags: Docker, Docker Hub, CVE-2026-105445, GhostPAT, Personal Access Tokens, Supply Chain Attack, Container Poisoning, Registry Security, Kubernetes
Executive Summary
The containerized software supply chain narrowly escaped a widespread integrity catastrophe following the discovery of a critical architectural vulnerability in Docker Hub, the world's most widely used container registry. Tracked as CVE-2026-105445 and dubbed "GhostPAT" by discovering security researchers Peter Molnar and Krisztian Hozak, the defect was assigned a critical CVSS v4.0 base score of 9.4 and a CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
As disclosed in Docker's Security Advisory and reported by BleepingComputer, The Hacker News, and ghostpat.com, the vulnerability resided in Docker Hub's account conversion feature, which allows personal user accounts to be converted into team organizations.
When a personal account was converted into an organization, the user's pre-existing Personal Access Tokens (PATs) were transferred into the organization's repository context. However, Docker Hub’s backend identity service failed to invalidate the original token creator's relationship. This allowed the original creator's token to retain persistent, unrevocable permissions to push, pull, overwrite, and delete container images within the newly created organization—even if the creator was never listed as an organization member or had their access revoked.
An adversary exploiting GhostPAT could silently poison base container images (e.g., overwriting production image tags like :latest), inject malicious backdoor layers, and propagate compromised containers into thousands of downstream enterprise Kubernetes clusters and CI/CD pipelines.
Technical Deep-Dive: Deconstructing the GhostPAT Identity Flaw
To understand how a token persistence defect enables container registry supply chain poisoning, we examine Docker Hub's account conversion workflow, the authorization failure, and downstream exploitation scenarios.
Stage
Actor / Subsystem
Action & Mechanics
Security Impact
1. Token Creation
Attacker (user_alpha)
Generates Personal Access Token (dckr_pat_alpha123...) with full read/write scopes.
Valid authentication credential established.
2. Namespace Conversion
Docker Hub Identity Engine
Account user_alpha converted into organization org_target. New admin designated.
Repositories moved to corporate organization context.
3. Authorization Defect
Backend Identity Service
Fails to invalidate token creator binding. Token retains active authorization mapping.
Token remains valid despite namespace shift.
4. Account Severance
Corporate Admin
user_alpha is removed or never added to org_target team roster.
User has no visible membership or audit footprint.
5. Token Exploitation
Attacker
Executes docker login using dckr_pat_alpha123 and pushes to org_target/app:latest.
Overwrites legitimate production images.
6. Supply Chain Fanout
Downstream Infrastructure
Enterprise CI/CD pipelines and Kubernetes pods automatically pull poisoned tag.
Backdoor distributed across production clusters.
1. The Component: Docker Hub IAM and Personal Access Tokens
Docker Hub serves as the backbone of modern container infrastructure:
* Authentication with PATs: Instead of using interactive account passwords, developers and automation pipelines utilize Personal Access Tokens (PATs) to authenticate against the Docker registry via the CLI (docker login, docker push).
* Account-to-Organization Conversions: When individual developer projects evolve into corporate software suites, Docker Hub provides a migration wizard that converts a personal namespace (e.g., docker.io/project/) into an organizational namespace (docker.io/org_project/), designating new team owners and administrative hierarchies.
2. Root Cause: The GhostPAT Token Persistence Flaw
The vulnerability discovered by researchers Peter Molnar and Krisztian Hozak stemmed from an edge-case authorization failure during namespace migration:
* Token Migration Without Invalidation: During the conversion process, the backend copied repository ownership metadata to the newly designated organization. However, the cryptographic token validation service continued to validate the original creator's user ID against the newly established organization.
* The "Ghost" Status: The original token creator was not added to the organization's member list, was not assigned a seat on the billing plan, and did not appear in the organizational audit log or team management console. To organization administrators, the user did not exist.
* Unrestricted Registry Access: Despite having no visible account affiliation, the creator’s pre-existing Personal Access Token retained full read, write, and delete privileges against the organization’s repositories. The token could push image tags, pull private proprietary images, and delete repository manifests indefinitely.
3. Attack Vectors & The Container Supply Chain Blast Radius
The implications of CVE-2026-105445 extended far beyond typical unauthorized access:
* Image Poisoning (Backdoored Tags): An adversary possessing a GhostPAT could push backdoored image layers to widely used public or private images. Because container deployments (Docker Compose, Kubernetes Deployments) frequently pull the :latest tag or semantic version tags (e.g., :v1.2.0), the compromised container would be deployed automatically across thousands of production servers.
* Trojan Conversions: Threat actors could establish an open-source tool under a personal account, encourage open-source contributors or companies to adopt and convert the account into an organizational project, and maintain secret, persistent access to push backdoor updates years later.
* Insider Threat and Offboarding Bypass: When an employee left a company after converting an account, IT teams revoking the employee's corporate SSO or email address had no way to discover or revoke the personal access token tied to the initial account conversion.
Docker's Response & Remediation
Docker demonstrated exceptional response agility upon receiving the vulnerability disclosure:
* Rapid Production Patch: Following responsible disclosure via Docker's Vulnerability Disclosure Program on September 30, 2026, Docker confirmed the vulnerability and deployed an architectural fix to production within four hours.
* Historical Audit & Notifications: Docker audited all account-to-organization conversions dating back to the feature's release and confirmed that no unauthorized token abuse had been detected. On October 2, Docker notified all organization owners whose namespaces had undergone account conversions to ensure full transparency.
Defensive Hardening Blueprint & Container Registry Governance
Organizations deploying containerized applications should enforce the following security controls across their container registries and CI/CD pipelines:
1. Audit & Rotate Personal Access Tokens (PATs)
* Organization administrators should review active Personal Access Tokens across Docker Hub and third-party registries.
* Immediately revoke and regenerate any legacy tokens associated with accounts that transitioned from personal to organizational namespaces prior to October 2026.
2. Implement Cryptographic Container Image Signing (Cosign / Sigstore)
Never rely solely on container image tags for integrity verification:
* Enforce Cryptographic Signatures: Implement Cosign (part of the Sigstore project) to sign all container images during CI/CD build pipelines using ephemeral keys and OIDC identity.
* Kubernetes Admission Control: Deploy admission controllers (such as Kyverno or OPA Gatekeeper) configured to reject any container image deployment whose cryptographic signature does not verify against trusted organization keys.
3. Enforce Docker Content Trust (DCT)
Enable Docker Content Trust on production hosts:export DOCKER_CONTENT_TRUST=1
When DCT is active, Docker CLI clients verify digital signatures against the Notary server, preventing the execution of unsigned or tampered container layers even if a threat actor successfully pushes a malicious tag to the registry.
4. Enforce Single Sign-On (SSO) and Fine-Grained Token Scoping
* Configure Docker Hub organizations to enforce mandatory Single Sign-On (SSO) and Multi-Factor Authentication (MFA).
* Require that all automation tokens use fine-grained, repository-specific scopes with strict expiration windows rather than account-wide access.
________________
For container security teardowns, cloud supply chain threat intelligence, and Kubernetes defense blueprints, subscribe to Digital Spying.