Bash Umask Issue in Dokku Affects Git Credential Security
CVE-2026-45407

5MEDIUM

Key Information:

Vendor

Dokku

Status
Dokku
Vendor
CVE Published:
26 June 2026

What is CVE-2026-45407?

Dokku, a Docker-powered PaaS, had a vulnerability in its git:auth command before version 0.38.2. The command's execution created a .netrc file with insecure permissions, specifically 0644, which allowed any local user with access to the Dokku home directory to read sensitive git credentials. This flaw undermined the intended security settings of the netrc binary, which typically enforces 0600 permissions for sensitive files. The issue has been addressed in version 0.38.2.

Affected Version(s)

dokku < 0.38.2

References

https://github.com/dokku/dokku/security/advisories/GHSA-x...
x_refsource_CONFIRM
https://github.com/dokku/dokku/pull/8589
x_refsource_MISC

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.