Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-26 | 1 | Disclosure1 |
| 2026-06-28 | 1 | Patch1 |
CVE-2026-45408 Command Injection in Dokku Prior to 0.38.2 via Crafted App Name https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45408
Post summary
CVE-2026-45408 exposes a command injection flaw in Dokku versions before 0.38.2, which can be triggered by manipulating the application name.
#CVE-2026-45408 - Critical Command Injection in #Dokku. #CVSS 9.0. No patch available. Mitigations required. Limit git push access and review app name validation. #CVEAlert @dokku #infosec #cybersecurity #developers More detailed info: https://www.valtersit.com/cve/CVE-2026-45408/
Post summary
CVE-2026-45408 is a critical command injection flaw in Dokku with CVSS 9.0; no patch exists but mitigations include restricting git push access and improving app name validation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dokku | dokku | - | - | - |