EUVD-2026-39802Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only exploitation (AV:L) requires an existing shell account (PR:L) and a prior admin git:auth invocation (UI:R); only plaintext credential confidentiality is impacted (C:H, I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.
AnalysisAI
Insufficiently protected credential storage in Dokku prior to 0.38.2 exposes git authentication secrets stored in $DOKKU_ROOT/.netrc to any local user who can traverse the Dokku home directory. The git:auth command pre-creates the .netrc file using bash's touch, which applies the process umask (0644) before the netrc binary runs - defeating the netrc binary's own 0600 enforcement because the file already exists at write time. No public exploit code exists and the vulnerability is not in CISA KEV, but the confidentiality impact is rated High given that plaintext git credentials (hostnames, usernames, passwords) are directly readable without any special tooling.
Technical ContextAI
Dokku (cpe:2.3:a:dokku:dokku:*:*:*:*:*:*:*:*) is a Docker-powered PaaS that stores git repository authentication credentials in a standard Unix .netrc file located at $DOKKU_ROOT/.netrc. The .netrc format is a plaintext credential store consumed by git, curl, and other network clients to authenticate to remote hosts. CWE-522 (Insufficiently Protected Credentials) is the root cause class: the vulnerable code path in plugins/git/internal-functions calls bash's built-in touch to pre-create the file, which inherits the shell's default umask of 0022, resulting in mode 0644 (owner read/write, group read, other read). Because the file already exists when the netrc utility subsequently writes credentials, the netrc binary's own 0600 permission logic applies only to newly created files and is silently bypassed. The fix in PR #8589 removes the touch call entirely and introduces fn-git-auth-secure-netrc(), which explicitly runs chmod 600 and chown after every git:auth operation, plus a migrate_netrc_permissions() function in the install hook that retroactively repairs pre-existing world-readable .netrc files on upgrade.
RemediationAI
Upgrade Dokku to version 0.38.2 or later, which is the vendor-released patch confirmed by the GitHub security advisory GHSA-xh7p-9crg-pchr and the merged PR at https://github.com/dokku/dokku/pull/8589. The upgrade automatically remediates existing world-readable .netrc files via the migrate_netrc_permissions() migration hook that runs chmod 600 and chown on any pre-existing .netrc at install time. For systems that cannot be immediately upgraded, manually enforce correct permissions with chmod 600 $DOKKU_ROOT/.netrc && chown dokku:dokku $DOKKU_ROOT/.netrc; note this is a temporary measure only, as any subsequent invocation of git:auth on an unpatched version will not re-secure the file. An additional compensating control is to restrict local user access to the Dokku home directory (chmod 700 $DOKKU_ROOT), though this may break Dokku's own operational assumptions and should be tested before applying in production.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today