CVE-2026-86002

Awaiting Analysis Awaiting Analysis - Queue

Remote Code Execution in Dokku via Docker-Options Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86002

EUVD

EUVD-2026-101291

Affected Vendors & Products

Vendor	Product	Version / Range
dokku	dokku	< 0.38.25

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

CVE-2026-86002 is a command injection vulnerability in Dokku versions before 0.38.25. It allows users with app-level access and remote SSH privileges to store malicious strings via the docker-options plugin. These strings are later processed by Bash eval during build, deploy, or run operations, enabling arbitrary command execution on the host as the Dokku user.

Detection Guidance

Check Dokku version with 'dokku version' to confirm if it is below 0.38.25. Inspect docker-options plugin usage in app configurations for suspicious strings like $(...) or backticks in Docker arguments. Review system logs for unexpected commands executed by the Dokku user during build, deploy, or run operations.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the host system with the privileges of the Dokku user. This could lead to unauthorized access, data theft, system compromise, or disruption of services. The impact includes potential loss of confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for GDPR and HIPAA. It may result in unauthorized exposure of sensitive data, non-compliance with data protection regulations, and potential legal consequences.

Mitigation Strategies

Upgrade Dokku to version 0.38.25 or later using the bootstrap script from the release notes. Remove or sanitize any untrusted Docker options in app configurations. Restrict app-level access to trusted users only. Monitor for signs of exploitation in logs.

Hi! I’m here to help you understand CVE-2026-86002. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70