CVE-2026-45406: Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval
Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename containing a single quote breaks the quoting and allows command substitution to execute arbitrary commands on the host as the dokku user during the app's next deploy. This vulnerability is fixed in 0.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dokkuto a version that resolves this vulnerability.Fixed in 0.38.2 - Compensating control
If you cannot immediately upgrade, mitigate by preventing untrusted apps/users from providing OpenResty include files with malicious filenames in the app's openresty/http-includes/ directory before the next Dokku deploy.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45406?
The severity of CVE-2026-45406 is critical with a score of 9.
How do I fix CVE-2026-45406?
To fix CVE-2026-45406, upgrade Dokku to version 0.38.2 or later.
What type of vulnerability is CVE-2026-45406?
CVE-2026-45406 is a remote code execution (RCE) vulnerability.
Who is affected by CVE-2026-45406?
Users of Dokku versions prior to 0.38.2 that utilize the openresty-vhosts plugin are affected by CVE-2026-45406.
What causes CVE-2026-45406?
CVE-2026-45406 is caused by the improper handling of filenames in the openresty-vhosts plugin, which allows for the injection of maliciously named files.