CVE-2026-54636: Dokku: OS Command Injection via app.json managed Cron

Synopsis

This is an OS command injection vulnerability in Dokku, a Docker-powered platform-as-a-service. An authenticated, low-privilege user who can push an app.json file can embed shell metacharacters (such as > or ;) in cron command entries, which the Dokku cron plugin executes on the host without adequate sanitization, breaking out of the Docker container and running arbitrary commands as the Dokku user. Successful exploitation gives the attacker full read, write, and availability impact on the host, scoped beyond the container. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dokku service over the network to push a malicious app.json payload.

• AuthenticationRequired

  Any low-privilege account with push access to a Dokku app is sufficient to deliver the malicious app.json cron entry.

• Victim interactionRequired

  A user or automated process with access to the Dokku deployment must trigger the app deployment or cron-plugin reload that processes the malicious app.json.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the malicious app.json is accepted; no race condition or special memory state is required.

Blast Radius

• The attacker executes arbitrary OS commands on the Dokku host as the Dokku user, breaking out of the Docker container boundary.
• All data readable by the Dokku user on the host is exposed, including app environment variables, secrets, and SSH keys.
• The attacker can modify or delete files on the host filesystem accessible to the Dokku user, including deployed app data and configuration.
• The attacker can disrupt or terminate any Dokku-managed service on the host, taking down running applications.