Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions
- Docker: 15 events in the last 90 days
- Previous: 10 days earlier · Trust Docker for the agents you don’t
What happened
On September 30, 2026, security researchers reported a vulnerability in Docker Hub’s identity and access management through our Vulnerability Disclosure Program. We confirmed the report and deployed a fix to production the same afternoon, less than four hours after receiving it. We then reviewed every account conversion back to the date the flaw was introduced, and on October 2, notified every user and organization…
Summary assembled by rule from the sources below