Compliance Impact

CVE-2026-45408 is a critical OS command injection vulnerability that allows an authenticated user to execute arbitrary commands as the Dokku user, potentially compromising confidentiality, integrity, and availability of the system.

Such a vulnerability could lead to unauthorized access or modification of sensitive data, which may impact compliance with standards and regulations like GDPR and HIPAA that require protection of personal and health information.

However, the provided information does not explicitly discuss the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-45408 is a critical OS command injection vulnerability in Dokku versions prior to 0.38.2. It occurs because the app name validation regex allows shell metacharacters such as semicolons, dollar signs, backticks, and pipes. When an authenticated user pushes to a git remote with a specially crafted app name containing these metacharacters, the name is embedded unquoted into a bash pre-receive hook script. This unquoted embedding allows bash to interpret the metacharacters as command separators, enabling the execution of arbitrary commands as the Dokku user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an authenticated user with push access to execute arbitrary commands on the server as the Dokku user. The CVSS score is 9.0 (Critical), indicating high severity. The attack can be performed remotely over the network with low complexity and requires only low privileges and user interaction. Successful exploitation can compromise confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if your Dokku installation is running a version prior to 0.38.2 and if there are git push attempts with app names containing shell metacharacters.

You can check the Dokku version installed by running the command:

• dokku --version

To detect potentially malicious git push attempts, you can monitor git pre-receive hook logs or audit git push commands for app names containing characters like ;, $, `, |, &.

For example, you can search your git logs or server logs for suspicious app names using commands like:

• grep -E '[;$`|&]' /var/lib/dokku/data/git-hooks/pre-receive.log
• journalctl -u dokku | grep -E '[;$`|&]'

Additionally, inspecting the git remote URLs or push commands for app names with shell metacharacters can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Dokku to version 0.38.2 or later, where the vulnerability has been fixed.

This update restricts app names to lowercase alphanumerics, dots, and hyphens, and quotes the app variable in the git pre-receive hook script to prevent command injection.

Until you can upgrade, consider restricting git push access to trusted users only and monitor git push activity for suspicious app names containing shell metacharacters.

If possible, apply temporary access controls or network restrictions to limit exposure.

Useful 0 Not Useful 0