Command Injection Vulnerability in Dokku Openresty Plugin
CVE-2026-45406

9CRITICAL

Key Information:

Vendor

Dokku

Status
Dokku
Vendor
CVE Published:
26 June 2026

What is CVE-2026-45406?

The Dokku platform, which is powered by Docker, has a vulnerability in the Openresty plugin that allows potential command injection attacks. Specifically, prior to version 0.38.2, the plugin copies files from an app's Git repository directory and interpolates their filenames into a shell string without proper escaping. This oversight enables attackers to introduce specially crafted filenames, leading to arbitrary command execution on the host system during the app's subsequent deployment cycle. Users are encouraged to upgrade to version 0.38.2 or later to mitigate this risk.

Affected Version(s)

dokku < 0.38.2

References

https://github.com/dokku/dokku/security/advisories/GHSA-g...
x_refsource_CONFIRM
https://github.com/dokku/dokku/pull/8588
x_refsource_MISC

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.