by Kastro
Paper/Archive/CVE-2026-86002

CVE-2026-86002

dokku dokku — Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

EPSS 0.6%CVSS 9.0
critical.is priorityof 100
36
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 46.7.467 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.

Affected

ProductAffectedFixed inSource
dokku< 0.38.25–CNA

Scores by source

GitHub_M (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/dokku/dokku/security/advisories/GHSA-fccf-j7qf-2xp9refgithub.com/dokku/dokku/pull/8848refgithub.com/dokku/dokku/commit/1a376c362215a5c7044a08b3e3905b1a5fddc821refgithub.com/dokku/dokku/releases/tag/v0.38.25