CVE-2026-86002criticalCWE-95

CVE-2026-86002: critical vulnerability in dokku

Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

Published

Follow this CVE+ Monitor dokku

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9epss 0.6%
Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
dokku · dokku
Related CVEs — dokku

In the same product, most dangerous first.

CVE-2026-54636CRITICALDokku: OS Command Injection via app.json managed CronEPSS 0.5%CVE-2026-45406CRITICALDokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through evalEPSS 0.5%CVE-2026-45405CRITICALDokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:addEPSS 0.5%CVE-2026-45408CRITICALDokku: OS Command Injection via App Name in Git Pre-Receive HookEPSS 0.4%CVE-2026-45407MEDIUMDokku: Git Credentials in .netrc Stored World-Readable Due to Premature touchEPSS 0.1%