CVE-2026-45407 Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch
Local attackers can read world-readable git credentials in Dokku's .netrc file due to premature file creation with default permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-45407?
CVE-2026-45407 is a medium-severity vulnerability in dokku, published on 26 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.
Weakness: CWE-522
Which versions are affected by CVE-2026-45407?
It affects 1 product.
Products include Dokku Dokku.
How do I fix CVE-2026-45407?
No fix has been published for CVE-2026-45407 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45407 being exploited?
There is no known exploitation of CVE-2026-45407 in the wild and no public exploit code.
Other vulnerabilities in dokku
- CVE-2026-45405 Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add
- CVE-2026-45406 Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval
- CVE-2026-45408 Dokku: OS Command Injection via App Name in Git Pre-Receive Hook
- CVE-2026-54636 Dokku: OS Command Injection via app.json managed Cron
Sources
Also known as GHSA-xh7p-9crg-pchr.