CVE-2026-54636: Dokku: OS Command Injection via app.json managed Cron
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokkuto a version that resolves this vulnerability.Fixed in 0.38.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54636?
CVE-2026-54636 has a critical severity rating of 9.
What type of vulnerability is CVE-2026-54636?
CVE-2026-54636 is classified as an OS Command Injection vulnerability.
How do I fix CVE-2026-54636?
To mitigate CVE-2026-54636, upgrade to Dokku version 0.38.7 or later where the issue is resolved.
What are the potential impacts of CVE-2026-54636?
CVE-2026-54636 can allow an attacker to execute arbitrary commands on the host system by exploiting the cron management functionality.
What is the affected software for CVE-2026-54636?
CVE-2026-54636 affects Dokku versions prior to 0.38.7.