What is the CVSS score of CVE-2026-54636?

CVE-2026-54636 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Docker are affected by CVE-2026-54636?

Dokku's cron plugin (versions before 0.38.7) contains a critical privilege escalation vulnerability (CVSS 9.9) that allows attackers with configuration access to break out of container isolation and…. A patch is available.

How to fix or mitigate CVE-2026-54636?

Within 24 hours: Identify all Dokku installations, confirm cron plugin deployment status, and document current versions and app.json access controls. Within 7 days: Upgrade all affected Dokku instances to version 0.38.7 or later and verify patch deployment across all hosts. Within 30 days: Audit and restrict app.json modification permissions to deployed applications and establish principle of least privilege for configuration changes.

Docker CVE-2026-54636

EUVD-2026-39806 CRITICAL

OS Command Injection (CWE-78)

2026-06-26 GitHub_M

Docker Command Injection Dokku

9.9

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

CRITICAL

qualitative

NVD

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Attacker needs deploy access (PR:L) but no victim interaction since cron fires automatically (UI:N), and breakout from container to host fully compromises a separate scope (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 19:13 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 19:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 26, 2026 - 19:07 vuln.today

cvss_changed

CVSS changed

Jun 26, 2026 - 19:07 NVD

9.0 (CRITICAL) 9.9 (CRITICAL)

Patch available

Jun 26, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 17:24 vuln.today

Analysis Generated

Jun 26, 2026 - 17:24 vuln.today

CVE Published

Jun 26, 2026 - 16:23 cve.org

CRITICAL 9.0

DescriptionNVD

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.

Articles & Coverage 1

News Critical RCE in Dokku Docker Cron Plugin (Pre-0.38.7) - CVE-2026-54636 Jun 27, 2026

AnalysisAI

Container-to-host command execution in Dokku's cron plugin (versions prior to 0.38.7) lets an actor who can control an application's app.json schedule break out of the Docker container and run arbitrary commands on the host as the privileged Dokku user. Because the cron command was interpolated into a shell-evaluated line, special characters such as ';' or '>' were interpreted on the host rather than confined to the container, yielding a scope-changing escape (CVSS 9.9). No public exploit has been identified at time of analysis, but the root cause and fix are fully documented in the vendor advisory and patch.