CVE-2026-54636: Dokku Docker PaaS RCE Vulnerability

CVE-2026-54636 Overview

CVE-2026-54636 is a command injection vulnerability in Dokku, a Docker-powered Platform-as-a-Service (PaaS). The flaw resides in the cron plugin, which parses commands from the app.json file to schedule tasks that run as the Dokku user on the host. Special shell characters such as > or ; in a cron command break out of the Docker container and execute arbitrary commands on the host. The issue affects all Dokku versions prior to 0.38.7 and is tracked under [CWE-78] OS Command Injection. Maintainers released a fix in version 0.38.7.

Critical Impact
An authenticated attacker who can supply an app.json file gains command execution on the underlying host as the Dokku user, escaping Docker container isolation.

Affected Products

Dokku versions prior to 0.38.7
Dokku cron plugin
Deployments consuming app.json from untrusted sources

Discovery Timeline

2026-06-26 - CVE-2026-54636 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-54636

Vulnerability Analysis

Dokku's cron plugin reads cron entries from the application's app.json manifest and registers them as system cron jobs owned by the Dokku user. The plugin passes the command string to the shell without sanitization, so shell metacharacters retain their meta-meaning. When cron executes the entry, the shell interprets characters such as ;, |, &&, >, and backticks, allowing attacker-supplied payloads to run alongside or instead of the intended container command.

Because the cron process runs on the host rather than inside the application container, the injected commands execute in the host context as the Dokku user. This user typically has permission to manage Docker, which extends the impact to full host compromise through Docker socket abuse.

Root Cause

The root cause is missing input validation and improper neutralization of special elements used in an OS command [CWE-78]. The cron plugin concatenates the app.json cron command field directly into a shell invocation rather than executing the command inside the container via docker exec with argument arrays.

Attack Vector

An attacker with the ability to push code or supply an app.json file to a Dokku deployment adds a cron entry containing shell metacharacters. On the next cron plugin refresh, Dokku writes the malicious command to the system crontab. When the scheduled time arrives, the payload executes on the host as the Dokku user, bypassing the container boundary. The Dokku user's Docker group membership commonly enables privilege escalation to root.

No verified public exploit code is available. Refer to the Dokku GitHub Security Advisory GHSA-72vm-7pc2-x95w for maintainer details.

Detection Methods for CVE-2026-54636

Indicators of Compromise

Entries in /var/spool/cron/crontabs/dokku containing shell metacharacters such as ;, >, |, or backticks outside expected dokku run invocations.
Unexpected child processes of cron or CRON running as the Dokku user that do not correspond to docker commands.
Modifications to app.json cron sections in Git history that introduce non-standard command syntax.

Detection Strategies

Audit all app.json files across managed applications for cron command fields containing shell metacharacters.
Monitor process creation on Dokku hosts for shells (sh, bash) spawned by cron under the Dokku user without a corresponding container context.
Alert on outbound network connections initiated by the Dokku user outside routine Docker Registry traffic.

Monitoring Recommendations

Enable auditd rules on the Dokku host to log execve calls made by the Dokku user and forward events to a centralized log platform.
Track changes to system crontabs and Dokku plugin data directories with file integrity monitoring.
Review Dokku deploy logs for cron plugin registration events tied to newly deployed or updated applications.

How to Mitigate CVE-2026-54636

Immediate Actions Required

Upgrade Dokku to version 0.38.7 or later on all hosts.
Inventory existing app.json cron entries and remove any commands containing shell metacharacters until the upgrade is verified.
Restrict who can push to Dokku Git remotes and supply app.json files, treating this input as privileged.

Patch Information

The vulnerability is fixed in Dokku 0.38.7. See the upstream fix in Dokku Pull Request #8672 and the coordinated disclosure in the Dokku Security Advisory GHSA-72vm-7pc2-x95w.

Workarounds

Disable the cron plugin on affected hosts until the upgrade to 0.38.7 completes.
Remove or comment out cron sections in all app.json files sourced from untrusted contributors.
Enforce code review on app.json changes and reject entries containing shell metacharacters in cron commands.

bash

# Upgrade Dokku on Debian/Ubuntu hosts
sudo apt-get update
sudo apt-get install --only-upgrade dokku
dokku version

# Temporary mitigation: disable the cron plugin
dokku plugin:disable cron