Saint GhostPat, the Token That Outlived Its Account

Patron of personal access tokens, container image registries, and accounts turned into organisations without much thought.

Life

On 12 October 2026 Peter Molnar and Krisztian Hozak revealed a Docker Hub flaw: create a throwaway account with an access token, convert it into an organisation naming a victim as the recipient, and the token passed intact and silently into the victim's account. From there it could read their private repositories and push images in their name. Docker fixed it less than four hours after the report, and says it found no evidence of abuse.

Prayer

O Saint GhostPat, spirit haunting accounts that are not yours, let every token die with whoever created it. Amen.

How to celebrate

Celebrated by rotating your Docker Hub tokens and checking who pushed the latest image, even though conversion no longer transfers tokens.

Inherit a token, inherit its ghosts.