Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename containing a single quote breaks the quoting and allows command substitution to execute arbitrary commands on the host as the dokku user during the app's next deploy. This vulnerability is fixed in 0.38.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-26 | 1 | Disclosure1 |
| 2026-06-28 | 1 | Patch1 |
If you run Dokku (self-hosted PaaS), upgrade to 0.38.2 today. CVE-2026-45406 is a command injection via filenames. Here's what breaks and how to fix it.
Post summary
Dokku 0.38.2 includes a patch that fixes CVE-2026-45406, a command‑injection vulnerability triggered by filenames; users should update immediately.
CVE-2026-45406 Command Injection in Dokku OpenResty-Vhosts Plugin Prior to 0.38.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45406
Post summary
The text announces a command injection flaw in Dokku’s OpenResty‑Vhosts plugin (versions before 0.38.2) and provides no exploit details, patches, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dokku | dokku | - | - | - |