Incorrect Privilege Assignment in Docker Hub Account Conversion

Executive Summary

This vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could perform actions like pulling, pushing, or deleting images within its scopes, including in organization repositories accessible to that user.

Useful 0 Not Useful 0

Detection Guidance

Check Docker Hub account settings for unauthorized organization ownership changes or transferred personal access tokens (PATs). Review token activity logs for suspicious authentications or repository access. Use Docker CLI commands like 'docker logout' to invalidate compromised tokens and 'docker login' to re-authenticate with new credentials.

Useful 0 Not Useful 0

Impact Analysis

If you are a Docker Hub user, an attacker could gain unauthorized access to your repositories or organization repositories by exploiting this vulnerability. They could pull, push, or delete images, potentially leading to data theft, unauthorized modifications, or service disruption. Users with PATs in scope are particularly at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data through compromised personal access tokens. Attackers could gain access to repositories containing regulated data, leading to unauthorized data exposure or modification. Docker confirmed no evidence of exploitation, but the risk of unauthorized access to sensitive repositories during the exposure window (August 26, 2024, to September 30, 2026) could violate data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Rotate all personal access tokens (PATs) associated with Docker Hub accounts, especially those used for registry access. Review and revoke any tokens that may have been reassigned without authorization. Audit repository permissions to ensure no unauthorized access remains.

Useful 0 Not Useful 0