CVE-2026-45408

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.

• CWE-78

• https://github.com/dokku/dokku/pull/8590Issue Tracking, Patch
• https://github.com/dokku/dokku/security/advisories/GHSA-9x85-7gxq-fcr3Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45401Open WebUI is a self-hosted artificial intelligence platform…8.5
• CVE-2026-45402Open WebUI is a self-hosted artificial intelligence platform…8.1
• CVE-2026-45403AnythingLLM is an application that turns pieces of content i…2.5
• CVE-2026-45405Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:fro…8.8
• CVE-2026-45406Dokku is a docker-powered PaaS. Prior to 0.38.2, the openres…8.8
• CVE-2026-45407Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:aut…5.5
• CVE-2026-45409Internationalized Domain Names in Applications (IDNA) for Py…5.3
• CVE-2026-4541A flaw has been found in janmojzis tinyssh up to 20250501. I…2.5
• CVE-2026-45410TREK is a collaborative travel planner. Prior to 3.0.18, ear…5.3
• CVE-2026-45411vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.…9.8
• CVE-2026-45412MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-45413MaxKB is an open-source AI assistant for enterprise. Prior t…6.9