Read the docs
TI-2026-33197 Aliases CVE-2026-45408

Dokku: OS Command Injection via App Name in Git Pre-Receive Hook

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed dokku (dokku): 0.38.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dokkudokkubefore 0.38.20.38.2Patch availableCNA
  • dokku Vendordokku Affected before 0.38.2 Fixed in 0.38.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dokku:dokku:*:*:*:*:-:*:*:*before 0.38.2Vulnerabledokku
  • cpe:2.3:a:dokku:dokku:*:*:*:*:-:*:*:* Versions before 0.38.2 Vulnerable ·dokku

Remediation

  • Fix · CNA dokku (dokku) Fixed in 0.38.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45408

References

Patch 1

Advisory 1

  • TI-2026-39465 Dokku: OS Command Injection via app.json managed Cron CVSS 3.1CRITICAL 9.9
  • TI-2026-33195 Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval CVSS 3.1CRITICAL 9.0
  • TI-2026-33194 Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add CVSS 3.1CRITICAL 9.0
  • TI-2026-33196 Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences