CVE-2026-45406: Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval

Synopsis

A command injection vulnerability in Dokku's openresty-vhosts plugin allows an attacker to execute arbitrary commands on the host by crafting a maliciously named file inside an app's openresty/http-includes/ git directory. The attack is reachable over the network and requires a low-privilege account plus a victim deploy action; the unescaped filename is interpolated into a single-quoted shell string that is passed to eval, breaking quoting and enabling command substitution. Successful exploitation gives the attacker full remote code execution on the host as the dokku user, with high impact to confidentiality, integrity, and availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dokku service over the network to push a repository containing the malicious filename (AV:N).

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker only needs push access to a Dokku app repository (PR:L).

• Victim interactionRequired

  A deploy of the affected app must be triggered, meaning a legitimate user or automated pipeline must initiate the deploy action after the malicious file is in place (UI:R).

• Attack complexityDetail

  Exploit conditions are reliable and free of environmental dependencies; crafting a filename that breaks single-quote shell interpolation is straightforward and repeatable (AC:L).

Blast Radius

• Executes arbitrary shell commands on the host as the dokku user, giving the attacker a persistent foothold on the underlying server.
• Reads secrets, environment variables, and credentials stored on the host or accessible to the dokku user, including app config and SSH keys.
• Modifies or deletes app data, configuration files, and deployed workloads on the host.
• Disrupts or destroys running containers and services managed by Dokku, causing full service outage.