Docker’s October 12 advisory describes a flaw in converting a personal account into an organization: a personal access token could move to a different owner without its secret changing. The fix was deployed September 30; potentially affected owners were notified October 2, and transferred tokens were deactivated October 8 except where owners opted out. Docker reports no evidence of exploitation, while noting that logs cannot prove an unused token did not exist. This is a lesson in identity transitions, not a newly unpatched emergency. Docker advisory · NVD record