CVE-2026-45407: Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKUROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dokkuto a version that resolves this vulnerability.Fixed in 0.38.2 - Operational
On Dokku versions prior to 0.38.2, after upgrading, ensure any existing $DOKKU_ROOT/.netrc file is removed/recreated with permissions no more permissive than 0600 so git credentials are not world-readable.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45407?
The severity of CVE-2026-45407 is rated as medium (5).
How do I fix CVE-2026-45407?
To fix CVE-2026-45407, upgrade Dokku to version 0.38.2 or later.
What type of vulnerability is CVE-2026-45407?
CVE-2026-45407 is a security vulnerability that exposes git credentials in a world-readable file.
What is the impact of CVE-2026-45407?
The impact of CVE-2026-45407 is that local users can read sensitive git credentials stored in the .netrc file.
Where does CVE-2026-45407 occur in Dokku?
CVE-2026-45407 occurs when the git:auth command creates the .netrc file with incorrect permissions due to the use of the touch command.