CVE-2026-45408: Dokku Dokku RCE Vulnerability

CVE-2026-45408 Overview

CVE-2026-45408 is a command injection vulnerability in Dokku, a Docker-powered Platform-as-a-Service (PaaS). Versions prior to 0.38.2 fail to properly sanitize application names when generating a bash pre-receive hook script. The app name validation regex ^[a-z0-9][^/:_A-Z]*$ permits shell metacharacters, which are then embedded unquoted into a heredoc in fn-git-create-hook(). An authenticated user pushing to a crafted git remote can execute arbitrary commands as the dokku user. This flaw is tracked as [CWE-78: OS Command Injection].

Critical Impact
Authenticated attackers can execute arbitrary shell commands as the dokku user by pushing to a git remote with a crafted application name.

Affected Products

Dokku versions prior to 0.38.2
Deployments exposing git push access to authenticated users
Self-hosted PaaS environments running vulnerable Dokku releases

Discovery Timeline

2026-06-26 - CVE-2026-45408 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-45408

Vulnerability Analysis

The vulnerability resides in fn-git-create-hook() at plugins/git/internal-functions:378. This function generates a bash pre-receive hook script for each Dokku application. The application name is interpolated into the script through an unquoted heredoc using <<EOF rather than the quoted form <<'EOF'. Unquoted heredocs perform shell expansion on their contents, so any shell metacharacters in the app name are processed by bash when the hook is written and later executed.

Dokku validates app names using the regex ^[a-z0-9][^/:_A-Z]*$. The negated character class only excludes forward slashes, colons, underscores, and uppercase letters. It permits characters such as ;, `, $, &, |, (, and ) — all of which have special meaning in bash. An attacker can register an app name containing a semicolon followed by arbitrary commands.

Root Cause

Two defects combine to produce the flaw. First, the validation regex is a denylist that fails to exclude shell metacharacters. Second, the heredoc delimiter in fn-git-create-hook() is unquoted, causing bash to interpret the interpolated app name as shell syntax rather than a literal string. Either defect alone would be less severe; together they yield direct command execution.

Attack Vector

Exploitation requires an authenticated account with permission to create applications and push to git remotes. The attacker creates an app whose name contains a shell metacharacter sequence, then performs a git push to the Dokku remote. When the pre-receive hook fires, bash parses the semicolon as a command separator and executes the injected payload under the dokku user account.

No verified public exploit code is available. Technical details are documented in the Dokku GitHub Security Advisory GHSA-9x85-7gxq-fcr3 and the upstream fix pull request.

Detection Methods for CVE-2026-45408

Indicators of Compromise

Application names in the Dokku app registry containing shell metacharacters such as ;, `, $, |, or &.
Unexpected processes spawned by the dokku user immediately following a git push event.
Modifications to files under ~dokku/, /home/dokku/, or generated pre-receive hook scripts that were not initiated by administrative activity.

Detection Strategies

Audit the Dokku app list with dokku apps:list and flag any names not matching a strict alphanumeric-and-hyphen allowlist.
Monitor the dokku user's shell history and process ancestry for suspicious child processes of git-receive-pack or pre-receive hooks.
Inspect generated hook scripts under each app's git directory for unexpected shell constructs injected outside the intended template.

Monitoring Recommendations

Ingest Dokku host authentication and process logs into a centralized SIEM and alert on command execution chains rooted in git-receive-pack.
Enable Linux audit rules (auditd) on the Dokku host to record execve calls originating from the dokku user account.
Track outbound network connections from the Dokku host that deviate from normal build and deploy behavior.

How to Mitigate CVE-2026-45408

Immediate Actions Required

Upgrade Dokku to version 0.38.2 or later, which quotes the heredoc delimiter and tightens app name validation.
Review all existing applications and delete any whose names contain shell metacharacters.
Restrict git push access to trusted users until the upgrade is complete.

Patch Information

The fix is included in Dokku 0.38.2. The upstream commit changes the heredoc in fn-git-create-hook() from <<EOF to <<'EOF', preventing shell expansion of the interpolated app name. Full details are available in the Dokku pull request #8590.

Workarounds

Enforce an allowlist regex on app creation that permits only [a-z0-9-]+, blocking all shell metacharacters at ingress.
Limit account provisioning so that only trusted operators can create applications or push to Dokku git remotes.
Run the Dokku daemon under a constrained user with reduced filesystem and sudo privileges until patching is complete.

bash

# Configuration example: upgrade Dokku to the patched release
sudo apt-get update
sudo apt-get install -y dokku=0.38.2
dokku version