Arbitrary Command Execution in Dokku by ElasticNode
CVE-2026-86002

9CRITICAL

Key Information:

Vendor

Dokku

Status
Dokku
Vendor
CVE Published:
14 October 2026

What is CVE-2026-86002?

The vulnerability in Dokku, a docker-powered platform as a service, allows users with app-level access and remote SSH permissions to execute docker-options commands. By leveraging the docker-options plugin, these users can store arbitrary strings that are later processed during build, deploy, or run operations. This results in shell command substitutions being interpreted on the host system, thereby enabling arbitrary command execution with the privileges of the operating system's dokku user. This security issue was addressed in version 0.38.25.

Affected Version(s)

dokku < 0.38.25

References

https://github.com/dokku/dokku/security/advisories/GHSA-f...
x_refsource_CONFIRM
https://github.com/dokku/dokku/pull/8848
x_refsource_MISC
https://github.com/dokku/dokku/commit/1a376c362215a5c7044...
x_refsource_MISC

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.