CVE-2026-86002 dokku CVE debrief

Who should care

Dokku users, administrators, and security teams should assess exposure and apply the fix to prevent potential critical consequences. This includes reviewing Dokku deployments, restricting access to docker-options commands, and monitoring for suspicious activity. The vulnerability's high CVSS score of 9 and potential for arbitrary command execution on the host with the privileges of the dokku operating-system user necessitate immediate attention.

Why it matters

A critical vulnerability in Dokku requires immediate attention for users to assess exposure and apply the fix to prevent potential arbitrary command execution on the host.

• Potential arbitrary command execution on the host with the privileges of the dokku operating-system user.
• Critical CVSS score of 9 indicating a high severity vulnerability.
• Possible lateral movement and exploitation with remote SSH access.
• Requires immediate attention and fix to prevent potential damage.

Technical summary

The Dokku vulnerability allows users with app-level Dokku access and remote SSH access to store arbitrary strings through the docker-options plugin. These strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations, leading to potential shell command substitutions and arbitrary command execution on the host. The vulnerability has a CVSS score of 9, indicating a high severity level. The issue is fixed in Dokku version 0.38.25. Dokku users should assess their exposure and apply the fix to prevent potential critical consequences.

Defensive priority

Immediate attention is required for Dokku users to assess exposure and apply the fix, as the vulnerability can lead to critical consequences with a CVSS score of 9.

Recommended defensive actions

• Assess Dokku deployment exposure, specifically checking for versions before 0.38.25 and ensuring that users with app-level Dokku access and remote SSH access are properly restricted.
• Apply the fix by updating Dokku to version 0.38.25 or later.
• Review and restrict docker-options commands to prevent arbitrary string storage and execution.
• Monitor for suspicious activity and implement compensating controls to limit potential damage.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to the vendor's advisory and fix. The Dokku project has released a fix for this vulnerability in version 0.38.25. Users with app-level Dokku access and remote SSH access can exploit this vulnerability. The vulnerability allows for arbitrary command execution on the host with the privileges of the dokku operating-system user. Evidence of exploitation includes logs of suspicious docker-options commands and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.