Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-45407 Insecure Git Credentials Storage in Dokku Prior to Version 0.38.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45407
Post summary
The content announces CVE-2026-45407 as an insecure Git credentials storage issue in Dokku versions before 0.38.2, referencing a vulnerability detail page, with no PoC, exploit, or mitigation provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dokku | dokku | - | - | - |