CVE-2026-86002
9.0CriticalPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-95
Impact
Authenticated users with app-level access and remote SSH permissions can execute arbitrary shell commands on the host as the dokku OS user. To exploit it, an attacker needs valid SSH credentials capable of running docker-options commands and a subsequent build, deploy, or run operation to trigger execution.
Root cause
The docker-options plugin accepts arbitrary strings that are concatenated into DOCKER_ARGS and passed unsanitized into a Bash eval call, executing embedded shell command substitutions.
Affected systems
Dokku versions prior to 0.38.25
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade Dokku to version 0.38.25 or newer. If you cannot upgrade immediately, restrict untrusted users from running dokku docker-options commands over SSH.
$ sudo apt-get update && sudo apt-get install --only-upgrade dokkuAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.