Command Injection in Dokku via Malicious cron in app.json

Executive Summary

CVE-2026-54636 is a critical security vulnerability in Dokku's cron plugin prior to version 0.38.7. The plugin processes cron commands defined in an app.json file and writes them directly into the host system's crontab running as the Dokku user.

Because these commands can include special shell characters like > or ;, an attacker can exploit this to break out of the Docker container and execute arbitrary commands on the host system with Dokku user privileges.

The vulnerability was fixed by changing how cron commands are executed, running them safely inside the container at runtime, and by validating app.json files to reject commands containing shell operators.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the cron jobs running as the Dokku user on the host system, specifically looking for cron commands originating from the app.json file that contain special shell characters such as > or ; which could allow command injection.

You can check the crontab entries for the Dokku user by running the following command on the host system:

• crontab -u dokku -l

Look for any cron commands that include shell metacharacters or appear to be directly executing commands from app.json without the safer wrapper command (`dokku cron:run <app> <cron-id>`).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with push access to an application to execute arbitrary commands on the host system outside the Docker container.

Since the commands run with the privileges of the Dokku user, this can lead to full compromise of the host system's confidentiality, integrity, and availability.

Potential impacts include unauthorized data access or modification, disruption of services, and further escalation of privileges on the host.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to execute arbitrary commands on the host system with the privileges of the Dokku user by escaping the Docker container through specially crafted cron commands. This can lead to unauthorized access, data breaches, and potential manipulation or disruption of system operations.

Such unauthorized access and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.

Therefore, if exploited, this vulnerability could result in violations of these regulations due to the risk of exposure or alteration of sensitive data and disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade Dokku to version 0.38.7 or later, where the issue has been fixed.

The fix involves changing the way cron commands are executed by using a safer format that runs commands inside the container at runtime and validating app.json files during deployment to reject commands containing shell operators.

Until you can upgrade, review and remove any cron commands in app.json files that contain special shell characters to prevent command injection.

Useful 0 Not Useful 0