Cybersecurity news: GhostPat is a Docker Hub authorization flaw (CVE-2026-105445) that, for over two years, let an attacker push, pull, or delete images as you — by creating an account, minting a personal access token, converting the account into an organization, and naming you as its owner. The token kept its secret and silently became yours at the registry. Docker fixed it on September 30 (under four hours after the report) and found no evidence of exploitation across ~304,000 reviewed pushes — but trust Docker's audit and verify. This free CVE check tool walks you through it. No signup, nothing installed.
Direct answer: check your Docker Hub audit log for pushes, pulls, or deletions you did not make between 2024 and September 30, 2026, and look for unexpected collaborators or PAT transfers on your namespaces. Docker reviewed ~304,000 pushes and found no exploitation — but verify your own repos. The 60-second check below walks you through it.
Check for Docker's email — on October 2, Docker emailed every user whose account received a transferred token, plus the org owners involved. Search your inbox for Docker Hub security notices from early October:
Audit your personal access tokens — hub.docker.com → Account Settings → Personal Access Tokens. Each token acts as your account at the registry with the permissions it was created with:
Review your repositories for phantom pushes — open each of your repos on Docker Hub and check the tags:
Lock it down going forward:
Nothing to install or patch — the fix was server-side on Docker Hub itself. Your job is verification + hygiene.
Drop a live exposure checker into your blog, docs, or forum post — three lines of HTML.
Get the embed codeThis page checked one flaw. BreachHunter hunts attacker infrastructure and compromise indicators — the phantom pushes and hijacked trust that supply-chain attacks leave behind.
GhostPat (CVE-2026-105445, CVSS 9.4 Critical) was a Docker Hub flaw open from August 2024 to September 2026: converting a personal account into an organization transferred the account's personal access tokens to the designated owner without changing the token secret or notifying them. An attacker could create an account, mint a token, convert the account naming a victim as owner — and the token would then work at the registry as the victim, able to push, pull, or delete images.
Docker says it found no evidence of exploitation after reviewing approximately 304,000 pushes made with transferred tokens and analyzing high-risk public images. On October 2, 2026 Docker emailed users whose accounts received transferred tokens; on October 8 it deactivated those tokens except where owners asked to keep them. There is no update to install — the fix was server-side.
(1) Search your email for Docker's October 2, 2026 notification — affected users were emailed directly. (2) Audit your personal access tokens at hub.docker.com under Account Settings and delete any you don't recognize. (3) Review your repositories for image tags you didn't push. (4) Rotate remaining tokens and enable two-factor authentication.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.