CVE-2026-45408 Dokku: OS Command Injection via App Name in Git Pre-Receive Hook

What is CVE-2026-45408?

CVE-2026-45408 is a critical command injection vulnerability in dokku, published on 26 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.

Weakness: CWE-78

Which versions are affected by CVE-2026-45408?

It affects 1 product.

Products include Dokku Dokku.

How do I fix CVE-2026-45408?

No fix has been published for CVE-2026-45408 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-45408 being exploited?

There is no known exploitation of CVE-2026-45408 in the wild and no public exploit code.

Other vulnerabilities in dokku

• CVE-2026-45405 Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add Critical 9.0
• CVE-2026-45406 Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval Critical 9.0
• CVE-2026-54636 Dokku: OS Command Injection via app.json managed Cron Critical 9.0
• CVE-2026-45407 Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9x85-7gxq-fcr3.