CVE-2026-54636: Dokku cron plugin OS command injection
CVE-2026-54636 affects the cron plugin of Dokku before 0.38.7, where commands declared in app.json are not safely handled and can escape the container to run on the host as the Dokku user. The advisory rates it critical, with NVD scoring 9.9 and GitHub scoring 9. No confirmed exploitation appears in the sources consulted, and the fix is available in 0.38.7.
Overview
Dokku is a Docker-powered platform as a service. According to the GitHub advisory, the cron plugin builds system cron entries, which run as the Dokku user, from commands declared in the app.json file. Before version 0.38.7, special shell characters in those commands were not handled safely, which the CNA classifies as OS command injection (CWE-78).
Impact
The source describes a container escape: commands can run on the host as the Dokku user. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which indicates network attack vector, low complexity, low privileges, no user interaction, scope change, and high confidentiality, integrity and availability impact. The GitHub score is 9.
Affected products and versions
- Dokku, versions prior to 0.38.7.
The record does not list any further affected version ranges or distributions.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00529 with a percentile of 0.43202.
Remediation and mitigation
- Upgrade Dokku to version 0.38.7 or later, as stated in the advisory and the patch reference.
- Review app.json cron entries in deployed applications and remove any unexpected or unneeded commands until the upgrade is complete.
- Restrict who can push application changes to the platform, since the cron commands come from application configuration.
Detection guidance
- Audit system cron entries created for the Dokku user and compare them with the app.json files of deployed applications.
- Look for cron jobs containing shell redirection or command separators that were not intentionally defined by the application owner.
- Monitor the host for unexpected processes started by the Dokku user.
Limitations of the available information
The record does not include a proof-of-concept description beyond the general statement, does not confirm which Dokku distributions or deployment configurations are affected, and does not document any workaround other than upgrading. The title was absent in the source record and was written by the analyst from the description.
Frequently asked questions
Which Dokku versions are affected by CVE-2026-54636?
The record lists Dokku versions prior to 0.38.7 as affected.
Is there a fix for this vulnerability?
The record states the vulnerability is fixed in version 0.38.7, and links a patch pull request in the Dokku repository.
Is this vulnerability known to be exploited in the wild?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.