CVE-2026-54636 Dokku: OS Command Injection via app.json managed Cron
Attackers can execute arbitrary host commands as the Dokku user by injecting shell characters into app.json cron entries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-54636?
CVE-2026-54636 is a critical command injection vulnerability in dokku, published on 26 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.
Weakness: CWE-78
Which versions are affected by CVE-2026-54636?
It affects 1 product.
Products include Dokku Dokku.
How do I fix CVE-2026-54636?
No fix has been published for CVE-2026-54636 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-54636 being exploited?
There is no known exploitation of CVE-2026-54636 in the wild and no public exploit code.
Other vulnerabilities in dokku
- CVE-2026-45405 Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add
- CVE-2026-45406 Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval
- CVE-2026-45408 Dokku: OS Command Injection via App Name in Git Pre-Receive Hook
- CVE-2026-45407 Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch
Sources
Also known as GHSA-72vm-7pc2-x95w.