Impact Analysis

This vulnerability can lead to unauthorized disclosure of your git credentials to any local user on the system who can traverse the Dokku home directory.

Since the .netrc file is world-readable due to improper permissions, sensitive credentials are exposed, which compromises confidentiality.

An attacker with local access and low privileges can exploit this vulnerability to read your git credentials, potentially leading to further unauthorized access.

The vulnerability has a moderate severity score of 5.0, reflecting its impact on confidentiality but limited to local access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should manually set the permissions of the .netrc file to be readable and writable only by the owner.

• Run the command: chmod 0600 /home/dokku/.netrc

Additionally, upgrading Dokku to version 0.38.2 or later will apply a fix that enforces strict permissions automatically and repairs existing installations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-45407 is a vulnerability in Dokku versions prior to 0.38.2 related to the creation of the .netrc file by the git:auth command.

The issue arises because the .netrc file is created using the touch command, which applies default file permissions of 0644, making the file world-readable.

This happens before the netrc binary can enforce its intended stricter permissions of 0600, which would restrict access to only the owner.

As a result, git credentials stored in the .netrc file are exposed and readable by any local user who can access the Dokku home directory.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the permissions of the .netrc file located in the Dokku home directory. If the permissions are set to 0644 or more permissive, the file is vulnerable because it is readable by other local users.

• Run the command: ls -l /home/dokku/.netrc
• If the output shows permissions like -rw-r--r-- (0644), the file is vulnerable.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability exposes git credentials stored in the .netrc file to any local user who can access the Dokku home directory due to improper file permissions (0644 instead of the intended 0600). This unauthorized exposure of sensitive credentials can lead to confidentiality breaches.

Such exposure of sensitive authentication data could potentially violate compliance requirements under standards like GDPR and HIPAA, which mandate strict controls over access to sensitive information to protect confidentiality and prevent unauthorized access.

Mitigation involves updating Dokku to version 0.38.2 or later, which enforces proper file permissions (0600) on the .netrc file, thereby reducing the risk of unauthorized access and helping maintain compliance with data protection regulations.

Useful 0 Not Useful 0