CVE-2026-86002: Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS
Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKERARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dokkuto a version that resolves this vulnerability.Fixed in 0.38.25
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs app-level Dokku access and remote SSH access sufficient to run docker-options commands. They can store a malicious Docker option that is later evaluated during build, deploy, or run operations.
What level of access does successful exploitation provide?
Successful exploitation allows arbitrary command execution on the Dokku host with the privileges of the dokku operating-system user. The affected stored value can use shell command substitution because DOCKER_ARGS is processed with Bash eval.
Which versions are affected and what is the fix?
Dokku versions before 0.38.25 are affected. Upgrade to Dokku 0.38.25, which fixes the issue.
When might a malicious stored Docker option execute?
The stored value is interpreted when Dokku performs a build, deploy, or run operation. Systems should review Docker options previously stored through the docker-options plugin for arbitrary or unexpected strings.