CVE-2026-45407: Dokku Information Disclosure Vulnerability

CVE-2026-45407 Overview

CVE-2026-45407 affects Dokku, a docker-powered Platform-as-a-Service (PaaS). The git:auth command creates the $DOKKU_ROOT/.netrc file using bash's touch command. The touch invocation applies the default umask of 0644, pre-creating the file before the netrc binary can enforce its intended 0600 permissions. Any local user able to traverse the Dokku home directory can read the stored Git credentials. The issue is tracked under [CWE-522: Insufficiently Protected Credentials] and is fixed in version 0.38.2.

Critical Impact
Local users with filesystem read access to the Dokku home directory can obtain Git credentials stored in .netrc, enabling unauthorized access to protected repositories.

Affected Products

Dokku versions prior to 0.38.2
Deployments using the git:auth command to store Git credentials
Multi-tenant hosts where non-privileged users can traverse $DOKKU_ROOT

Discovery Timeline

2026-06-26 - CVE-2026-45407 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-45407

Vulnerability Analysis

Dokku's git:auth command manages HTTP(S) authentication for Git remotes by writing credentials to a .netrc file under $DOKKU_ROOT. The netrc binary responsible for populating this file enforces 0600 permissions to keep credentials confidential. The Dokku shell logic invokes touch on the target path before delegating to the netrc binary. Because touch respects the process umask (default 0022), the created file receives 0644 permissions. When netrc subsequently writes to the existing file, its permission-setting logic does not override the already-applied mode, leaving the credentials world-readable.

Root Cause

The root cause is a file creation ordering flaw. Pre-creating .netrc with touch bypasses the secure permission enforcement built into the netrc binary. This results in a credentials-at-rest exposure covered by CWE-522.

Attack Vector

Exploitation requires local access with low privileges. A non-privileged user on the Dokku host who can traverse the Dokku home directory can read $DOKKU_ROOT/.netrc and extract plaintext Git credentials. Those credentials can then be used to clone or push to private repositories, potentially enabling supply-chain compromise of applications deployed through Dokku.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-xh7p-9crg-pchr and Pull Request #8589 for the technical fix.

Detection Methods for CVE-2026-45407

Indicators of Compromise

Presence of $DOKKU_ROOT/.netrc with permissions other than 0600 (e.g., 0644).
Access log entries showing non-dokku users reading files under $DOKKU_ROOT.
Unexpected authenticated Git operations originating from hosts using credentials stored in Dokku's .netrc.

Detection Strategies

Audit file permissions on $DOKKU_ROOT/.netrc across all Dokku hosts and flag any world- or group-readable state.
Enable filesystem auditing (auditd on Linux) on $DOKKU_ROOT/.netrc to log read attempts by non-privileged accounts.
Correlate Git provider access logs for the credentialed user against expected deployment activity to spot anomalous authentications.

Monitoring Recommendations

Alert on any process other than dokku or netrc opening $DOKKU_ROOT/.netrc for read.
Track Dokku version inventory and flag hosts running any release prior to 0.38.2.
Monitor for local privilege escalation attempts or shell access by unexpected accounts on Dokku hosts.

How to Mitigate CVE-2026-45407

Immediate Actions Required

Upgrade Dokku to version 0.38.2 or later on all affected hosts.
Rotate any Git credentials that were previously stored via dokku git:auth on vulnerable versions.
Restrict shell access to Dokku hosts and review existing local user accounts.

Patch Information

The fix is delivered in Dokku 0.38.2. The upstream change removes the pre-creation of .netrc with touch so that the netrc binary creates the file directly with 0600 permissions. Review GitHub Pull Request #8589 and GitHub Security Advisory GHSA-xh7p-9crg-pchr for full remediation details.

Workarounds

Manually enforce chmod 0600 $DOKKU_ROOT/.netrc after any invocation of git:auth until the upgrade is applied.
Restrict directory traversal by setting $DOKKU_ROOT to 0700 and ensuring ownership is limited to the dokku user.
Avoid using dokku git:auth on vulnerable versions and use SSH-based Git remotes where feasible.

bash

# Post-upgrade verification and hardening
sudo dokku version
sudo stat -c '%a %U:%G %n' /home/dokku/.netrc
sudo chmod 0600 /home/dokku/.netrc
sudo chown dokku:dokku /home/dokku/.netrc
sudo chmod 0700 /home/dokku