Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-86002Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

Critical 9.0

In plain English

A critical-severity security flaw in dokku from dokku. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.

Affected products (as reported)

VendorProductVersions
dokku dokku < 0.38.25

Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References