Strix
26.1K

CVE-2026-54636

CRITICALCVSS 9.9/10

Last modified

CVE-2026-54636 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user.

Description

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.

Metrics

CVSS 3.1
9.9/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness Enumeration

Affected Software

VendorProductVersions
DokkuDokku< 0.38.7

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2026-54636?
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.
How severe is CVE-2026-54636?
CVE-2026-54636 has a CVSS score of 9.9/10 (CRITICAL severity).
How do I fix CVE-2026-54636?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-54636?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST