Docker Hub CVE: PATs transferred during account-to-org conversions

Mon, 12 Oct 2026 20:04:11 +0000

Platform/SRE — Plan: If any Docker Hub personal accounts were converted to organizations in your org, PATs used for image pulls in infrastructure tooling may have been re-assigned to unintended owners. Audit and rotate affected Docker Hub PATs; no hard deadline but treat as a near-term security hygiene task.
CI/CD — Plan: Docker Hub PATs are widely embedded in CI/CD pipelines for registry auth; if any team converted a personal Docker Hub account to an org, those tokens may have changed hands. Identify any converted accounts and rotate all associated PATs in pipeline secrets before they can be leveraged.
Leader — Skip
Signals: CVE-2026-105445 — CISA KEV: not listed, EPSS n/a

Docker-Hub on CuraDevOps