CVE-2026-45408: Dokku PaaS OS Command Injection via Crafted App Name on Git Push
CVE-2026-45408 affects Dokku versions prior to 0.38.2. The app name validation permits shell metacharacters, and an authenticated user who pushes to a git remote with a crafted app name can cause arbitrary commands to run as the dokku user. The record reports a fix in 0.38.2 and a CVSS 3.1 score of 9.
Overview
Dokku is a Docker-based PaaS. CVE-2026-45408 describes an OS command injection flaw (CWE-78) in how application names are handled during a git push. The name validation allows shell metacharacters, and the name is placed into a generated pre-receive hook script without proper quoting. The record states that the issue is fixed in 0.38.2.
Impact
- The CNA-assigned CVSS 3.1 vector describes a network-reachable attack with low complexity, low privileges required, user interaction required, and a changed scope.
- The record rates confidentiality, integrity and availability impact as high.
- According to the description, successful exploitation executes arbitrary commands as the dokku user on the server.
Affected products and versions
- Product: Dokku (listed as Dokku Dokku in the record).
- Affected range in the record: versions before 0.38.2.
- Fixed version according to the record: 0.38.2. The vendor advisory is the authoritative source for the exact release details.
Exploitation status
The CISA KEV catalog does not list this CVE in the record provided, so no confirmed active exploitation is reported in the sources consulted. The EPSS probability is 0.00419 with a percentile of 0.34403 as of the date in the record. EPSS is a predictive estimate and does not confirm exploitation.
Remediation and mitigation
- Upgrade Dokku to version 0.38.2 or later, as stated in the record and the vendor advisory.
- Limit which accounts can push to Dokku git remotes, since the flaw requires an authenticated user.
- Review existing application names for unexpected characters and investigate any that do not match the expected naming pattern.
- The record does not describe a workaround. Treat any workaround as unknown until confirmed by the vendor.
Detection guidance
- Review git push logs and deployment hook output for unusual characters or unexpected output in application names.
- Audit the list of Dokku applications and their names for entries that do not follow the expected format.
- Monitor the dokku system account for processes or file changes that are not explained by normal deployments.
Limitations of the available information
- The record provided has no English title, so the title in this analysis was written from the description.
- The record does not provide a workaround, detailed exploitation prerequisites beyond the description, or confirmed exploitation reports.
- The EPSS date in the record is later than the publication date, and this analysis does not reconcile that difference.
- The vendor advisory and the fix pull request were not reviewed in full for this analysis; only their URLs appear in the record.
Frequently asked questions
What is CVE-2026-45408?
It is an OS command injection vulnerability in Dokku, a Docker-based PaaS. An authenticated user can use a crafted application name during git push to run arbitrary commands as the dokku user, according to the record.
Which versions are affected?
The record lists Dokku versions before 0.38.2 as affected. The fix is stated to be in 0.38.2.
Is this vulnerability being actively exploited?
The CISA KEV catalog does not list this CVE in the record provided, so no confirmed active exploitation is reported in the sources consulted.
What should administrators do?
Upgrade Dokku to 0.38.2 or later, limit which accounts can push to git remotes, and review existing application names for unexpected characters.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.