CVE-2026-45406: Dokku Dokku RCE Vulnerability

CVE-2026-45406 Overview

CVE-2026-45406 is a command injection vulnerability in Dokku, a Docker-powered Platform-as-a-Service (PaaS). The flaw resides in the openresty-vhosts plugin, which copies files from an app's openresty/http-includes/ git repository directory to the host. During processing, the plugin interpolates filenames, unescaped, into a single-quoted shell string that is later parsed by eval. An attacker who controls a filename containing a single quote can break the quoting and inject arbitrary shell commands. Execution occurs on the host as the dokku user during the app's next deploy. The vulnerability affects Dokku versions prior to 0.38.2 and is tracked under [CWE-95].

Critical Impact
An attacker with the ability to push filenames into an app's git repository can execute arbitrary commands on the Dokku host as the dokku user during deploy, compromising confidentiality, integrity, and availability of all hosted apps.

Affected Products

Dokku versions prior to 0.38.2
The openresty-vhosts plugin
Deployments using OpenResty vhost integration via openresty/http-includes/

Discovery Timeline

2026-06-26 - CVE-2026-45406 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-45406

Vulnerability Analysis

The openresty-vhosts plugin in Dokku extends OpenResty configuration by allowing apps to ship custom http include files inside the openresty/http-includes/ directory of their git repository. During deployment, the plugin copies these files to the host and iterates over their filenames to build an OpenResty configuration snippet. The filenames are interpolated directly into a single-quoted shell string, which is subsequently evaluated by eval. Because filenames are attacker-controlled through the git repository, a crafted filename containing a single quote terminates the quoted context and enables shell command substitution. The injected commands execute on the host with the privileges of the dokku user during the next deploy, giving the attacker control over the PaaS host and its tenants.

Root Cause

The root cause is improper neutralization of directives in dynamically evaluated code [CWE-95]. Filenames from an untrusted source, the app's git repository, are concatenated into a shell command without escaping single quotes or other shell metacharacters. Passing the resulting string to eval converts filename metadata into executable shell syntax.

Attack Vector

An attacker requires the ability to add a file to the app's openresty/http-includes/ directory in the git repository. This can occur through a compromised developer account, a malicious pull request that is merged, or any workflow that grants push access to a Dokku-managed app. The attacker creates a file whose name contains a single quote followed by command substitution syntax such as $(...) or a backtick expression. On the next git push deploy, the openresty-vhosts plugin runs the crafted filename through eval, executing the injected commands as the dokku user. That account typically has broad access to Docker, other apps, and secrets on the host.

No verified public proof-of-concept code has been published. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-45406

Indicators of Compromise

Files inside openresty/http-includes/ in any app repository with names containing single quotes, backticks, $(, or shell metacharacters.
Unexpected child processes spawned by the dokku user during or immediately after a git push deploy.
Modifications to files outside the app's container, such as SSH keys, cron entries, or plugin directories, following a deploy.

Detection Strategies

Audit all app repositories for filenames under openresty/http-includes/ that contain shell metacharacters or non-alphanumeric characters beyond dot, dash, and underscore.
Review deploy logs for eval errors, unexpected command output, or shell parse warnings emitted by the openresty-vhosts plugin.
Compare running Dokku plugin versions against 0.38.2 and flag hosts still on vulnerable releases.

Monitoring Recommendations

Enable process auditing (auditd or equivalent) on the Dokku host to log execve calls made by the dokku user during deploys.
Alert on outbound network connections initiated by the dokku user that do not correspond to expected registry or build traffic.
Track integrity of /home/dokku and plugin directories to detect tampering that persists across deploys.

How to Mitigate CVE-2026-45406

Immediate Actions Required

Upgrade Dokku to version 0.38.2 or later on all hosts running the openresty-vhosts plugin.
Restrict push access to Dokku-managed git repositories to trusted maintainers until the upgrade is complete.
Scan existing app repositories for files under openresty/http-includes/ with suspicious filenames and remove them before the next deploy.

Patch Information

The vulnerability is fixed in Dokku 0.38.2. Refer to the GitHub Pull Request for the code change and the GitHub Security Advisory for the official vendor disclosure.

Workarounds

Temporarily disable or remove the openresty-vhosts plugin until the upgrade to 0.38.2 is applied.
Enforce filename validation in pre-receive git hooks to reject files under openresty/http-includes/ that contain characters outside a strict allowlist.
Require code review on all changes touching openresty/http-includes/ to prevent malicious filenames from reaching deploy.

bash

# Configuration example: upgrade Dokku and verify the fixed version
sudo apt-get update
sudo apt-get install --only-upgrade dokku
dokku version
# Expected: dokku version >= 0.38.2