CVE-2026-86002

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/dokku/dokku/commit/1a376c362215a5c7044a08b3e3905b1a5fddc821
https://github.com/dokku/dokku/pull/8848
https://github.com/dokku/dokku/releases/tag/v0.38.25
https://github.com/dokku/dokku/security/advisories/GHSA-fccf-j7qf-2xp9

Configurations

No configuration.

History

14 Oct 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-14 16:17

Updated : 2026-10-16 16:00

NVD link : CVE-2026-86002

Mitre link : CVE-2026-86002

CVE.ORG link : CVE-2026-86002

JSON object : View

Products Affected

No product.

CWE

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

{"id": "CVE-2026-86002", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86002", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-14T17:45:06.294502Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dokku", "product": "dokku", "versions": [{"status": "affected", "version": "< 0.38.25"}]}]}], "published": "2026-10-14T16:17:54.470", "references": [{"url": "https://github.com/dokku/dokku/commit/1a376c362215a5c7044a08b3e3905b1a5fddc821", "source": "security-advisories@github.com"}, {"url": "https://github.com/dokku/dokku/pull/8848", "source": "security-advisories@github.com"}, {"url": "https://github.com/dokku/dokku/releases/tag/v0.38.25", "source": "security-advisories@github.com"}, {"url": "https://github.com/dokku/dokku/security/advisories/GHSA-fccf-j7qf-2xp9", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-95"}]}], "descriptions": [{"lang": "en", "value": "Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25."}], "lastModified": "2026-10-16T16:00:33.533", "sourceIdentifier": "security-advisories@github.com"}