CVE-2026-45408: Dokku: OS Command Injection via App Name in Git Pre-Receive Hook
Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:A-Z]$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dokkuto a version that resolves this vulnerability.Fixed in 0.38.2 - Compensating control
If you cannot upgrade immediately, prevent authenticated users from pushing to the affected git remote with crafted app names (e.g., restrict who can push to the git remote / enforce app-name allowlisting before push).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45408?
CVE-2026-45408 has a severity rating of critical, with a score of 9.
How do I fix CVE-2026-45408?
To fix CVE-2026-45408, update Dokku to version 0.38.2 or later.
What type of vulnerability is CVE-2026-45408?
CVE-2026-45408 is classified as an OS Command Injection vulnerability.
What software is affected by CVE-2026-45408?
CVE-2026-45408 affects the Dokku software platform.
What is the impact of exploiting CVE-2026-45408?
Exploiting CVE-2026-45408 can allow an attacker to execute arbitrary commands on the server through crafted app names.