CVE-2026-54636
Last modified
CVE-2026-54636 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dokku | Dokku | < 0.38.7 |
References
- https://github.com/dokku/dokku/pull/8672Issue Tracking, Patch
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-54636?
How severe is CVE-2026-54636?
How do I fix CVE-2026-54636?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-54629Anyquery is an SQL query engine built on top of SQLite. Prio…7.5
- CVE-2026-5463Command injection vulnerability in console.run_module_with_o…9.8
- CVE-2026-54632SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NE…7.5
- CVE-2026-54633PoDoFo is a C++17 PDF manipulation library. From version 1.0…6.9
- CVE-2026-54634Hamlib is a ham radio control library for radios, rotators, …7.3
- CVE-2026-54635pytonapi is a Python SDK for TONAPI that provides REST API, …7.5
- CVE-2026-54637Dragonfly is an open source P2P-based file distribution and …5.5
- CVE-2026-54638gotd/td is a T Telegram MTProto API client in Go. Prior to 0…7.5
- CVE-2026-54639Style Dictionary, a build system for creating cross-platform…8.8
- CVE-2026-5464The ExactMetrics – Google Analytics Dashboard for WordPress …7.2
- CVE-2026-54642CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.3
- CVE-2026-54643CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.4
Are you affected by CVE-2026-54636?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST