A critical command-injection flaw in Dokku's cron plugin lets an app.json cron command break out of its Docker container and run arbitrary commands on the host as the Dokku user.
What Is It
Dokku is a Docker-powered Platform-as-a-Service (PaaS). In versions prior to 0.38.7, the cron plugin reads commands from an application's app.json file to manage system cron jobs that run as the Dokku user. Because these commands are not properly sanitized, an app.json cron command containing special shell characters, including, but not limited to, > or ;, can break out of the Docker container and execute commands directly on the host. The issue is classified as CWE-78 (OS Command Injection).
Why It Matters
NVD rates this vulnerability CRITICAL, with a primary CVSS 3.1 base score of 9.9 (vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H); the secondary score from the GitHub advisory is 9.0. The flaw has network attack vector, low complexity, requires only low privileges, and crosses a security boundary (scope changed) to deliver high confidentiality, integrity, and availability impact. A successful escape gives an attacker code execution on the host outside the container sandbox; undermining the core isolation guarantee of a containerized PaaS.
What's Vulnerable
All Dokku releases prior to 0.38.7 are affected (cpe:2.3:a:dokku:dokku with version less than 0.38.7). Environments that deploy apps defining cron commands via app.json are exposed.
Patch Status
The vulnerability is fixed in Dokku 0.38.7. Operators should upgrade to 0.38.7 or later. The CISA KEV catalog contains no entry for this CVE in the supplied data, so there is no confirmation of active exploitation at this time.
Sources
- NVD, CVE-2026-54636: https://nvd.nist.gov/vuln/detail/CVE-2026-54636
- Dokku Security Advisory GHSA-72vm-7pc2-x95w: https://github.com/dokku/dokku/security/advisories/GHSA-72vm-7pc2-x95w
- Dokku Patch PR #8672: https://github.com/dokku/dokku/pull/8672