CVE-2026-86002

CriticalCVSS 9.0

Published: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Summary

Dokku before 0.38.25 allows a user with app-level access and remote SSH to store arbitrary strings via docker-options, which are later concatenated into DOCKER_ARGS and processed by Bash eval, leading to arbitrary command execution with dokku user privileges.

Risk Assessment

An attacker can execute arbitrary commands on the host, leading to full system compromise.

Recommendation

Upgrade Dokku to version 0.38.25 or later and restrict permissions for users with docker-options access.

Other vulnerabilities in Dokku

CVE-2026-54636Critical
A vulnerability in Dokku prior to version 0.38.7 allows escape from a Docker container via special shell characters in cron commands in the app.json file. An attacker can execute arbitrary commands on the host as the Dokku user.

Original NVD description (English source)

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS