Database/Container, Kubernetes & orchestration

Dokku: stored docker-options values reach bash eval, giving command execution as the dokku user

CVSS 9.0CVE-2026-86002Container, Kubernetes & orchestrationcurated

Impact

Values stored through the docker-options plugin are concatenated into DOCKER_ARGS and later evaluated by bash during build, deploy or run, so shell command substitutions inside them execute on the host. Any user with app-level Dokku access and SSH reach to run docker-options escalates from "can configure one app" to arbitrary commands as the dokku OS user - which owns every app on the box, its container configuration and its deploy credentials. For an operator this is a tenancy boundary failure on a shared PaaS host rather than a container escape in the runtime itself.

Who can reach it

Authenticated - needs app-level Dokku access plus remote SSH access to invoke docker-options commands. Execution lands on the next build, deploy or run operation.

What to do

Upgrade Dokku to 0.38.25. That is a host package update plus the next deploy; no node reboot. Review existing docker-options values on affected apps for injected substitutions before redeploying, and audit who holds app-level Dokku access.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-86002 https://github.com/dokku/dokku/security/advisories/GHSA-fccf-j7qf-2xp9 https://github.com/dokku/dokku/releases/tag/v0.38.25 https://github.com/dokku/dokku/commit/1a376c362215a5c7044a08b3e3905b1a5fddc821

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.