Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions

What happened

Their technical write-up is available at ghostpat.com . If you did not receive an email, you and any members of the organizations you administer were not exposed and there are no actions for you to take.

Read what happened, who was affected, and the fix. What the vulnerability was Docker Hub lets you convert a personal account into an organization.

People do this because Hub has no way to move a repository from one account to another: conversion is how alice/app becomes an organization-owned alice/app without breaking every Docker pull that references it. During conversion, the user names an existing Docker Hub account as the new organization’s owner.