CVE-2026-45406: critical vulnerability in dokku
Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval
Published
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9epss 0.5%
exploitation probability
0.5%top 57% of all CVEs
observed exploitation
nono source reports it
Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename containing a single quote breaks the quoting and allows command substitution to execute arbitrary commands on the host as the dokku user during the app's next deploy. This vulnerability is fixed in 0.38.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
dokku · dokkuRelated CVEs — dokku
In the same product, most dangerous first.
CVE-2026-54636CRITICALDokku: OS Command Injection via app.json managed CronEPSS 0.5%CVE-2026-45405CRITICALDokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:addEPSS 0.5%CVE-2026-45408CRITICALDokku: OS Command Injection via App Name in Git Pre-Receive HookEPSS 0.4%CVE-2026-45407MEDIUMDokku: Git Credentials in .netrc Stored World-Readable Due to Premature touchEPSS 0.1%