CVE-2026-45408: Dokku: OS Command Injection via App Name in Git Pre-Receive Hook

Synopsis

OS command injection in Dokku, the Docker-powered PaaS platform, allows an authenticated user with any account to run arbitrary commands on the host by pushing to a Git remote using a crafted app name. The flaw is reachable over the network, requires a low-privilege account and a single user-triggered Git push, and gives the attacker full code execution as the dokku system user, compromising confidentiality, integrity, and availability. A patched-image rebuild at version 0.38.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dokku Git service over the network to send the malicious push.

• AuthenticationRequired

  Any low-privilege Dokku account is sufficient; no administrator credentials are needed.

• Victim interactionRequired

  The attacker must perform a Git push, which is a deliberate user-initiated action that triggers the vulnerable pre-receive hook.

• Attack complexityDetail

  Exploitation is reliable and condition-free: inserting shell metacharacters into the app name requires no race condition or special memory layout.

Blast Radius

• The attacker executes arbitrary OS commands as the dokku user, giving them a shell on the host.
• All application data, environment variables, and secrets stored on the Dokku host are readable by the attacker.
• The attacker can modify or delete deployed application containers, persisted volumes, and Git repositories hosted on the instance.
• The attacker can terminate running containers or exhaust host resources, taking down all applications hosted on the Dokku instance.