Transferred PATs is the Important line in the Docker Hub advisory

So Docker Hub put a security advisory on the feed, dated October 12, 2026. We flagged it Important as a security fix. The headline sounds narrow: personal access tokens transferred during account-to-organization conversions. Plenty of people will read "conversion," decide they never converted anything, and move on. Most of them are right. Some of them own a CI pipeline that already broke on October 8 and don't know why yet.

Here's the mechanism, to the best of my understanding. Hub has no way to move a repository between accounts, so people convert a personal account into an organization to keep alice/app pullable under the same name. During conversion you name an existing account as the new organization's owner. Starting August 26, 2024, that step also re-pointed the converted account's personal access tokens (PATs) at the new owner. The token secret wasn't rotated or revoked, and the named owner was never asked or told. So someone could make an account, mint a PAT, convert the account, name you as owner, and keep holding a token that now authenticated to the registry as you. Within the token's scope, that meant pull, push, and delete on your repositories and on organizations you could reach. Docker rated it critical as a supply chain risk (CVE-2026-105445). It didn't reach the web UI, passwords, email, or two-factor settings.

The reassuring part is real. Docker fixed it on September 30, less than four hours after the report, and went back through every conversion in the window. They looked at about 304,000 pushes made with transferred tokens and found no evidence anyone exploited it. In most cases the converted account and the new owner were the same person or team, which is just the feature working as intended. Docker also says plainly that a token nobody used leaves no trace in the logs, so they treated every PAT that moved through a conversion as potentially affected.

That's where the partner ticket comes from. On October 2, Docker emailed the affected users and their organization owners with the subject "Docker Hub Vulnerability Identified & Resolved". On October 8 at 3:45 PM Eastern, they deactivated the transferred PATs, except for ones the owner asked to keep before the deadline. Since most conversions were legitimate, some of those tokens were probably still doing real work: a build job pushing images, a deploy step pulling a private base image, a mirror sync. If nobody read that email, the first sign was an unauthorized on docker push sometime after October 8, with nothing in the repo changed.

What to check first isn't whether you were attacked. Docker's answer there is no evidence of it. Check whether you converted an account into an organization at any point since August 2024, and search your inbox and your org owners' inboxes for that October 2 subject line. If it's there, it lists the in-scope tokens by description and creation date. Find where those tokens live in CI secrets, and replace them with an organization access token instead of another person's PAT. That's Docker's own recommendation for automation owned by an organization. If you got no email, Docker says nothing on your account was transferred and you have nothing to do. Going forward, conversion no longer carries PATs over at all, so a new owner has to create fresh credentials after a conversion.

Docker is also adding consent before someone can be named an organization owner, a notification when it happens, and an audit history of token ownership changes, and it's reviewing other flows that move credential ownership. Good changes, and probably the ones people will quote. They aren't the line that changes what operators do this week.

I nearly filed this under "platform advisory, no action unless you got the email." That's the wrong habit with teams that run registry automation on someone's personal token and assume a token keeps working until somebody revokes it on purpose. Tracking product change here means asking which line turns into a ticket. The talking point isn't "Docker fixed a token bug in four hours." It's that PATs moved through organization conversions were force-deactivated on October 8, so any pipeline still using one needs an organization access token now. After that, mention the consent and audit changes. We pull it into the same entry shape as everything else at /sources/docker-hub.updates.

Official advisory: Docker Hub security advisory: CVE-2026-105445.