CVE-2026-45405: Dokku Docker PaaS RCE Vulnerability

CVE-2026-45405 Overview

CVE-2026-45405 is a symlink traversal vulnerability in Dokku, a docker-powered Platform-as-a-Service (PaaS). The git:from-archive and certs:add commands extract user-supplied tar and zip archives into temporary directories without sanitizing member paths or blocking symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries. An authenticated attacker can write arbitrary files anywhere writable by the dokku user, including overwriting ~/.ssh/authorized_keys to gain shell access. The issue is fixed in Dokku 0.38.2 and is tracked under [CWE-59] (Improper Link Resolution Before File Access).

Critical Impact
An attacker with permission to invoke git:from-archive or certs:add can achieve unrestricted shell access as the dokku user by overwriting SSH authorized keys.

Affected Products

Dokku versions prior to 0.38.2
Dokku git:from-archive command
Dokku certs:add command

Discovery Timeline

2026-06-26 - CVE-2026-45405 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-45405

Vulnerability Analysis

Dokku accepts user-supplied archives through two administrative commands. The git:from-archive command deploys applications from tar or zip archives, while certs:add imports TLS certificates from archives. Both commands extract archive contents into temporary directories owned by the dokku user.

The extraction routines do not validate archive member paths and do not disable symlink following. When GNU tar processes an archive, it creates symlinks in the order they appear. Any subsequent archive entry that targets a path traversing one of those symlinks writes through the link to an attacker-chosen destination.

Because the dokku user typically owns critical service files, including its own SSH configuration, an attacker can overwrite ~/.ssh/authorized_keys. The resulting access converts a limited deployment capability into full interactive shell access on the host.

Root Cause

The root cause is missing path sanitization and unsafe symlink handling during archive extraction. Neither command normalizes member paths against the extraction directory, nor does it pass options that prevent tar from creating or following symlinks pointing outside the destination. This maps to [CWE-59], improper link resolution before file access.

Attack Vector

Exploitation requires an authenticated user with permission to invoke git:from-archive or certs:add. The attacker crafts a malicious archive containing a symlink entry that points to a directory such as /home/dokku/.ssh/, followed by a regular file entry whose path traverses that symlink. Extraction then writes the attacker's authorized_keys content into the SSH configuration directory, enabling remote login as the dokku user.

No verified public exploit is available at this time. Technical details are documented in the GitHub Security Advisory GHSA-j6qq-xg73-ghqg and the fixing pull request #8591.

Detection Methods for CVE-2026-45405

Indicators of Compromise

Unexpected modifications to /home/dokku/.ssh/authorized_keys or other files in the dokku user's home directory.
New symlinks inside Dokku temporary extraction directories pointing outside the extraction root.
Successful SSH logins as the dokku user from unrecognized source addresses following recent git:from-archive or certs:add invocations.

Detection Strategies

Audit shell command history and Dokku logs for git:from-archive and certs:add calls originating from non-administrative accounts.
Inspect archives supplied to Dokku for entries containing .. path components or symlink members with absolute or traversal targets.
Correlate archive extraction events with subsequent file writes outside the expected temporary directory using file integrity monitoring.

Monitoring Recommendations

Enable file integrity monitoring on /home/dokku/.ssh/, systemd unit files, and any path writable by the dokku user.
Log and alert on SSH authorized_keys changes across all service accounts.
Retain Dokku command audit logs and forward them to a central SIEM for correlation with authentication events.

How to Mitigate CVE-2026-45405

Immediate Actions Required

Upgrade Dokku to version 0.38.2 or later on all hosts.
Review /home/dokku/.ssh/authorized_keys for entries that were not added by administrators and remove unauthorized keys.
Restrict which users are permitted to invoke git:from-archive and certs:add until the upgrade is complete.

Patch Information

The vulnerability is fixed in Dokku 0.38.2. The upstream fix is available in pull request #8591 and documented in the GHSA-j6qq-xg73-ghqg advisory. Administrators should apply the update through their normal package management workflow and restart affected services.

Workarounds

Deny non-trusted users access to the git:from-archive and certs:add subcommands until patching is complete.
Validate archive contents on a separate, isolated host before uploading them to Dokku.
Run Dokku hosts with restrictive umask and mandatory access controls to limit blast radius from writes by the dokku user.

bash

# Upgrade Dokku on Debian/Ubuntu to the patched release
sudo apt-get update
sudo apt-get install --only-upgrade dokku=0.38.2
dokku version