Docker Hub account conversions carried personal access tokens to a new owner for 765 days

An admin searching a shared inbox for the subject line "Docker Hub Vulnerability Identified & Resolved" either finds the message or does not. Docker says it sent that email at 5:30 PM Eastern on October 2 to the limited number of users it judged exposed ^[2]. Its advice for everyone else is short: if no email arrived, neither you nor the members of the organizations you administer were exposed, and there is nothing to do ^[3].

The check is narrower than whether a team ever converted an account. Conversion is routine, because Hub has no way to move a repository between accounts and conversion is how alice/app becomes an organization-owned alice/app without breaking pulls ^[4]. In the attack Docker describes, the converter is the attacker ^[7]. In our reading, the person to look for is whoever on staff was named owner on an account they did not create. A team that converted its own account and named its own admin moved its own tokens.

Docker said an attacker could potentially pull, push or delete images, both in the target's own repositories and in any organization the target could access. With that access an attacker could ship images under the genuine name, so Docker treated the flaw as a software supply chain risk and rated it critical ^[8]. It did not open the Hub web interface, and it could not change the target's password, email address or two-factor settings ^[9].

The window ran from 20:33 UTC on August 26, 2024 ^[10] to a fix at about 3:10 PM Eastern on September 30, 2026 ^[11]. That is 730 days to August 26, 2026 plus 35 more, or 765 days ^[16]. The report reached Docker at 11:40 AM on the day of the fix, a gap of 3 hours 30 minutes ^[11][17].

Every one of the roughly 304,000 pushes Docker examined landed in the converted organization's own repositories or the new owner's own ^[15]. That is Docker's finding from Docker's logs, and the count it gives is of pushes.

We'd sort each account on two facts: whether the October 2 email reached a mailbox someone reads, and whether the holder opted out of the October 8 deactivation.

- No email: Docker says no action. Confirm the address on the Hub account is monitored, since the email is the only signal Docker describes. - Email, no opt-out: the transferred tokens were deactivated on October 8 ^[13]. Find the pipelines that used them and issue replacements. - Email, opted out: those tokens were left active on October 8 ^[13]. Revoke them, or give each one an owner and a rotation date.